Threats Tagged 'cve-2026-14355'

Multiple security vulnerabilities have been identified and fixed in PHP packages distributed by Red Hat for Red Hat Enterprise Linux 8 and 9. These include a memory corruption issue in the OpenSSL extension (CVE-2026-14355), an SQL injection vulnerability in the PostgreSQL extension due to improper backslash escaping (CVE-2026-17543), and a denial of service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). The vulnerabilities affect PHP versions 7.4 and 8.0 as packaged in Red Hat Enterprise Linux. Red Hat has released updated packages with backported fixes for these issues. The overall security impact is rated low to important depending on the PHP version and specific vulnerability.

A security update for php8 addresses a buffer allocation flaw in the AES-WRAP-PAD algorithm implementation within the OpenSSL extension. This flaw is tracked as CVE-2026-14355 and is fixed in version 8.4.23. The vulnerability has been assigned a medium severity rating.

A memory corruption vulnerability exists in the PHP OpenSSL extension's AES-WRAP-PAD algorithm implementation in versions prior to 8.2.32, 8.3.32, 8.4.23, and 8.5.8. The issue is due to incorrect buffer allocation that does not consider RFC 5649 expansion, which can lead to heap corruption and application aborts. Red Hat has released updates for Red Hat Hardened Images RPMs to address this flaw.