Incorrect default permissions in PHP - CVE-2020-7063

Vulnerability identifier: #VU25592

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7063

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to incorrect default permissions for files and folders that are set during the Phar::buildFromIterator() call when adding files into tar archive. A local user can extract files from tar archive and gain access to otherwise restricted information.

PHP
Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Oracle Solaris
Opensuse
openEuler
Fedora
Red Hat Software Collections
Tenable.sc
php7.0 (Debian package)
php7 (Alpine package)
php-xmlrpc
php-soap
php-devel
php-common
php-xml
php-pgsql
php-intl
php-cli
php-opcache
php-mysqlnd
php-json
php-odbc
php-embedded
php-tidy
php-process
php-bcmath
php-recode
php-gmp
php-dba
php-dbg
php-debugsource
php-fpm
php-help
php-debuginfo
php-gd
php-pdo
php-ldap
php
php-snmp
php-mbstring
php-enchant
php7.3 (Debian package)
rh-php73-php (Red Hat package)

Install updates from vendor's website.

PHP - addressed in versions 7.2.28, 7.3.15, 7.4.3
Tenable.sc - update to 5.19.0
php7.0 (Debian package) - update to 7.0.33-0+deb9u8
php7 (Alpine package) - update to 7.2.31-r0
php-xmlrpc - update to 7.2.10-8
php-soap - update to 7.2.10-8
php-devel - update to 7.2.10-8
php-common - update to 7.2.10-8
php-xml - update to 7.2.10-8
php-pgsql - update to 7.2.10-8
php-intl - update to 7.2.10-8
php-cli - update to 7.2.10-8
php-opcache - update to 7.2.10-8
php-mysqlnd - update to 7.2.10-8
php-json - update to 7.2.10-8
php-odbc - update to 7.2.10-8
php-embedded - update to 7.2.10-8
php-tidy - update to 7.2.10-8
php-process - update to 7.2.10-8
php-bcmath - update to 7.2.10-8
php-recode - update to 7.2.10-8
php-gmp - update to 7.2.10-8
php-dba - update to 7.2.10-8
php-dbg - update to 7.2.10-8
php-debugsource - update to 7.2.10-8
php-fpm - update to 7.2.10-8
php-help - update to 7.2.10-8
php-debuginfo - update to 7.2.10-8
php-gd - update to 7.2.10-8
php-pdo - update to 7.2.10-8
php-ldap - update to 7.2.10-8
php - update to 7.2.10-8
php-snmp - update to 7.2.10-8
php-mbstring - update to 7.2.10-8
php-enchant - update to 7.2.10-8
php - addressed in versions 7.3.15-1.fc30, 7.3.15-1.fc31
php7.3 (Debian package) - update to 7.3.19-1~deb10u1
rh-php73-php (Red Hat package) - update to 7.3.20-1.el7

• https://www.php.net/ChangeLog-7.php
• https://bugs.php.net/bug.php?id=79082

• Multiple vulnerabilities in PHP
• Amazon Linux AMI update for php73
• Amazon Linux AMI update for php72
• OpenSUSE Linux update for php7
• Gentoo update for PHP
• Oracle Solaris update for third party packages
• Debian update for php7.0
• Incorrect default permissions in php7 (Alpine package)
• Red Hat Software Collections 1 for RHEL 7.7 update for rh-php73-php
• Multiple vulnerabilities in Tenable.sc
• Debian update for php7.3
• openEuler 20.03 LTS update for php
• Red Hat Enterprise Linux 8 update for the php:7.3 module
• Fedora 31 update for php
• Fedora 30 update for php