CVE-2022-31626
mysqlnd/pdo password buffer overflow
概要
mysqlnd/pdo password buffer overflow
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
影響パッケージ
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-31626 php7.4 修正版: 7.4.30-1+deb11u1
参照URL
- advisory bugs.php.net
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov