CVE-2022-31628
phar wrapper can occur dos when using quine gzip file
Résumé
phar wrapper can occur dos when using quine gzip file
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Paquets affectés
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.4.31"},{"introduced":"8.0.0"},{"fixed":"8.0.24"},{"introduced":"8.1.0"},{"fixed":"8.1.11"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-31628 php7.4 Corrigé dans: 7.4.33-1+deb11u1
Références
- advisory bugs.php.net
- advisory lists.debian.org
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov