SUSE: CVE-2024-2756: SUSE Linux Security Advisory
4
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
04/26/2024
04/29/2024
04/29/2024
05/03/2024
Description
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
Solution(s)
- suse-upgrade-apache2-mod_php7
- suse-upgrade-apache2-mod_php74
- suse-upgrade-apache2-mod_php8
- suse-upgrade-apache2-mod_php81
- suse-upgrade-php7
- suse-upgrade-php7-bcmath
- suse-upgrade-php7-bz2
- suse-upgrade-php7-calendar
- suse-upgrade-php7-cli
- suse-upgrade-php7-ctype
- suse-upgrade-php7-curl
- suse-upgrade-php7-dba
- suse-upgrade-php7-devel
- suse-upgrade-php7-dom
- suse-upgrade-php7-embed
- suse-upgrade-php7-enchant
- suse-upgrade-php7-exif
- suse-upgrade-php7-fastcgi
- suse-upgrade-php7-fileinfo
- suse-upgrade-php7-fpm
- suse-upgrade-php7-ftp
- suse-upgrade-php7-gd
- suse-upgrade-php7-gettext
- suse-upgrade-php7-gmp
- suse-upgrade-php7-iconv
- suse-upgrade-php7-intl
- suse-upgrade-php7-json
- suse-upgrade-php7-ldap
- suse-upgrade-php7-mbstring
- suse-upgrade-php7-mysql
- suse-upgrade-php7-odbc
- suse-upgrade-php7-opcache
- suse-upgrade-php7-openssl
- suse-upgrade-php7-pcntl
- suse-upgrade-php7-pdo
- suse-upgrade-php7-pgsql
- suse-upgrade-php7-phar
- suse-upgrade-php7-posix
- suse-upgrade-php7-readline
- suse-upgrade-php7-shmop
- suse-upgrade-php7-snmp
- suse-upgrade-php7-soap
- suse-upgrade-php7-sockets
- suse-upgrade-php7-sodium
- suse-upgrade-php7-sqlite
- suse-upgrade-php7-sysvmsg
- suse-upgrade-php7-sysvsem
- suse-upgrade-php7-sysvshm
- suse-upgrade-php7-test
- suse-upgrade-php7-tidy
- suse-upgrade-php7-tokenizer
- suse-upgrade-php7-xmlreader
- suse-upgrade-php7-xmlrpc
- suse-upgrade-php7-xmlwriter
- suse-upgrade-php7-xsl
- suse-upgrade-php7-zip
- suse-upgrade-php7-zlib
- suse-upgrade-php74
- suse-upgrade-php74-bcmath
- suse-upgrade-php74-bz2
- suse-upgrade-php74-calendar
- suse-upgrade-php74-ctype
- suse-upgrade-php74-curl
- suse-upgrade-php74-dba
- suse-upgrade-php74-devel
- suse-upgrade-php74-dom
- suse-upgrade-php74-enchant
- suse-upgrade-php74-exif
- suse-upgrade-php74-fastcgi
- suse-upgrade-php74-fileinfo
- suse-upgrade-php74-fpm
- suse-upgrade-php74-ftp
- suse-upgrade-php74-gd
- suse-upgrade-php74-gettext
- suse-upgrade-php74-gmp
- suse-upgrade-php74-iconv
- suse-upgrade-php74-intl
- suse-upgrade-php74-json
- suse-upgrade-php74-ldap
- suse-upgrade-php74-mbstring
- suse-upgrade-php74-mysql
- suse-upgrade-php74-odbc
- suse-upgrade-php74-opcache
- suse-upgrade-php74-openssl
- suse-upgrade-php74-pcntl
- suse-upgrade-php74-pdo
- suse-upgrade-php74-pgsql
- suse-upgrade-php74-phar
- suse-upgrade-php74-posix
- suse-upgrade-php74-readline
- suse-upgrade-php74-shmop
- suse-upgrade-php74-snmp
- suse-upgrade-php74-soap
- suse-upgrade-php74-sockets
- suse-upgrade-php74-sodium
- suse-upgrade-php74-sqlite
- suse-upgrade-php74-sysvmsg
- suse-upgrade-php74-sysvsem
- suse-upgrade-php74-sysvshm
- suse-upgrade-php74-tidy
- suse-upgrade-php74-tokenizer
- suse-upgrade-php74-xmlreader
- suse-upgrade-php74-xmlrpc
- suse-upgrade-php74-xmlwriter
- suse-upgrade-php74-xsl
- suse-upgrade-php74-zip
- suse-upgrade-php74-zlib
- suse-upgrade-php8
- suse-upgrade-php8-bcmath
- suse-upgrade-php8-bz2
- suse-upgrade-php8-calendar
- suse-upgrade-php8-cli
- suse-upgrade-php8-ctype
- suse-upgrade-php8-curl
- suse-upgrade-php8-dba
- suse-upgrade-php8-devel
- suse-upgrade-php8-dom
- suse-upgrade-php8-embed
- suse-upgrade-php8-enchant
- suse-upgrade-php8-exif
- suse-upgrade-php8-fastcgi
- suse-upgrade-php8-fileinfo
- suse-upgrade-php8-fpm
- suse-upgrade-php8-ftp
- suse-upgrade-php8-gd
- suse-upgrade-php8-gettext
- suse-upgrade-php8-gmp
- suse-upgrade-php8-iconv
- suse-upgrade-php8-intl
- suse-upgrade-php8-ldap
- suse-upgrade-php8-mbstring
- suse-upgrade-php8-mysql
- suse-upgrade-php8-odbc
- suse-upgrade-php8-opcache
- suse-upgrade-php8-openssl
- suse-upgrade-php8-pcntl
- suse-upgrade-php8-pdo
- suse-upgrade-php8-pgsql
- suse-upgrade-php8-phar
- suse-upgrade-php8-posix
- suse-upgrade-php8-readline
- suse-upgrade-php8-shmop
- suse-upgrade-php8-snmp
- suse-upgrade-php8-soap
- suse-upgrade-php8-sockets
- suse-upgrade-php8-sodium
- suse-upgrade-php8-sqlite
- suse-upgrade-php8-sysvmsg
- suse-upgrade-php8-sysvsem
- suse-upgrade-php8-sysvshm
- suse-upgrade-php8-test
- suse-upgrade-php8-tidy
- suse-upgrade-php8-tokenizer
- suse-upgrade-php8-xmlreader
- suse-upgrade-php8-xmlwriter
- suse-upgrade-php8-xsl
- suse-upgrade-php8-zip
- suse-upgrade-php8-zlib
- suse-upgrade-php81
- suse-upgrade-php81-bcmath
- suse-upgrade-php81-bz2
- suse-upgrade-php81-calendar
- suse-upgrade-php81-cli
- suse-upgrade-php81-ctype
- suse-upgrade-php81-curl
- suse-upgrade-php81-dba
- suse-upgrade-php81-devel
- suse-upgrade-php81-dom
- suse-upgrade-php81-embed
- suse-upgrade-php81-enchant
- suse-upgrade-php81-exif
- suse-upgrade-php81-fastcgi
- suse-upgrade-php81-ffi
- suse-upgrade-php81-fileinfo
- suse-upgrade-php81-fpm
- suse-upgrade-php81-fpm-apache
- suse-upgrade-php81-ftp
- suse-upgrade-php81-gd
- suse-upgrade-php81-gettext
- suse-upgrade-php81-gmp
- suse-upgrade-php81-iconv
- suse-upgrade-php81-intl
- suse-upgrade-php81-ldap
- suse-upgrade-php81-mbstring
- suse-upgrade-php81-mysql
- suse-upgrade-php81-odbc
- suse-upgrade-php81-opcache
- suse-upgrade-php81-openssl
- suse-upgrade-php81-pcntl
- suse-upgrade-php81-pdo
- suse-upgrade-php81-pgsql
- suse-upgrade-php81-phar
- suse-upgrade-php81-posix
- suse-upgrade-php81-readline
- suse-upgrade-php81-shmop
- suse-upgrade-php81-snmp
- suse-upgrade-php81-soap
- suse-upgrade-php81-sockets
- suse-upgrade-php81-sodium
- suse-upgrade-php81-sqlite
- suse-upgrade-php81-sysvmsg
- suse-upgrade-php81-sysvsem
- suse-upgrade-php81-sysvshm
- suse-upgrade-php81-test
- suse-upgrade-php81-tidy
- suse-upgrade-php81-tokenizer
- suse-upgrade-php81-xmlreader
- suse-upgrade-php81-xmlwriter
- suse-upgrade-php81-xsl
- suse-upgrade-php81-zip
- suse-upgrade-php81-zlib
Advanced vulnerability management analytics and reporting.
Key Features
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center