CVE-2022-31628
MEDIUM5.5EPSS 0.01%phar wrapper can occur dos when using quine gzip file
發布日:2022/9/28修改日:2026/4/28
描述
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
受影響套件(5)
- Bitnami/libphpfrom 0, < 7.4.31, >= 8.0.0, < 8.0.24, >= 8.1.0, < 8.1.11
- Bitnami/phpfrom 0, < 7.4.31, >= 8.0.0, < 8.0.24, >= 8.1.0, < 8.1.11
- Bitnami/php-minfrom 0, < 7.4.31, >= 8.0.0, < 8.0.24, >= 8.1.0, < 8.1.11
- Debian/php7.4from 0, < 7.4.33-1+deb11u1
- Debian/php7.4from 0, < 7.4.33-1+deb11u1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
參考連結(10)
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2022-31628
- WEBhttps://bugs.php.net/bug.php?id=81726
- WEBhttps://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/
- WEBhttps://nvd.nist.gov/vuln/detail/CVE-2022-31628
- WEBhttps://security.gentoo.org/glsa/202211-03
- WEBhttps://security.netapp.com/advisory/ntap-20221209-0001/
- WEBhttps://www.debian.org/security/2022/dsa-5277