CVE-2022-31628
28.09.2022, 23:15
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
| Vendor | Product | Version |
|---|---|---|
| php | php | 𝑥 < 7.4.31 |
| php | php | 8.0.0 ≤ 𝑥 < 8.0.24 |
| php | php | 8.1.0 ≤ 𝑥 < 8.1.11 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| php5 |
| ||||||||||||||||||
| php7.0 |
| ||||||||||||||||||
| php7.2 |
| ||||||||||||||||||
| php7.4 |
| ||||||||||||||||||
| php8.1 |
|
Common Weakness Enumeration
- CWE-674 - Uncontrolled RecursionThe product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References