ByteOS Network

NVD Vulnerability Details :

CVE-2022-31628

Modified

Source-security@php.net

Published At-28 Sep, 2022 | 23:15

Updated At-07 Nov, 2023 | 03:47

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Secondary	3.1	2.3	LOW	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CPE Matches

The PHP Group

>>php>>Versions before 7.4.31(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

The PHP Group

>>php>>Versions from 8.0.0(inclusive) to 8.0.24(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

The PHP Group

>>php>>Versions from 8.1.0(inclusive) to 8.1.11(exclusive)

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Fedora Project

>>fedora>>35

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Fedora Project

>>fedora>>36

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Fedora Project

>>fedora>>37

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>10.0

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>11.0

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-835	Primary	nvd@nist.gov
CWE-674	Secondary	security@php.net

References

Hyperlink	Source	Resource
https://bugs.php.net/bug.php?id=81726	security@php.net	Permissions Required Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html	security@php.net	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/	security@php.net	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/	security@php.net	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/	security@php.net	N/A
https://security.gentoo.org/glsa/202211-03	security@php.net	Third Party Advisory
https://security.netapp.com/advisory/ntap-20221209-0001/	security@php.net	Third Party Advisory
https://www.debian.org/security/2022/dsa-5277	security@php.net	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History