Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-91769 →
UBUNTU-CVE-2026-91769
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
php5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:16.04:LTS
php7.0
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:18.04:LTS
php7.2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:Pro:20.04:LTS
php7.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
php8.1
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
php8.3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
php8.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
php8.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com
- report github.com