CVE-2022-31626
mysqlnd/pdo password buffer overflow
Résumé
mysqlnd/pdo password buffer overflow
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Paquets affectés
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"7.4.0"},{"fixed":"7.4.30"},{"introduced":"8.0.0"},{"fixed":"8.0.20"},{"introduced":"8.1.0"},{"fixed":"8.1.7"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-31626 php7.4 Corrigé dans: 7.4.30-1+deb11u1
Références
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- advisory github.com
- web bugs.php.net
- web lists.debian.org