CVE-2022-31628
phar wrapper can occur dos when using quine gzip file
Summary
phar wrapper can occur dos when using quine gzip file
Original description
The description as published by the source.
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-31628 php7.4 Fixed in: 7.4.33-1+deb11u1
References
- advisory bugs.php.net
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov