Vulnerability-Lookup

RHSA-2023_0848

Vulnerability from csaf_redhat - Published: 2023-02-21 09:35 - Updated: 2024-11-25 02:52

Summary

Red Hat Security Advisory: php:8.0 security update

Severity

Moderate

Notes

Topic: An update for the php:8.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666) Security Fix(es): * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454) * php: standard insecure cookie could be treated as a `__Host-` or `__Secure-` cookie by PHP applications (CVE-2022-31629) * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630) * php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631) * php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-4900

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 286 products

Product	Version	Remediation
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:apcu-panel-0:5.1.20-1.module+el8.6.0+13671+84712317.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-0:1.7.3-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debugsource-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debugsource-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debugsource-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-debugsource-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-devel-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-devel-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-devel-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-devel-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:libzip-tools-debuginfo-0:1.7.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-bcmath-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-cli-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-common-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dba-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-dbg-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debugsource-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debugsource-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debugsource-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-debugsource-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-devel-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-devel-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-devel-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-devel-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-embedded-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-enchant-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ffi-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-fpm-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-gmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-intl-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-ldap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mbstring-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-mysqlnd-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-odbc-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-opcache-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pdo-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pear-1:1.10.13-1.module+el8.6.0+13671+84712317.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pear-1:1.10.13-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-0:5.1.20-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-0:5.1.20-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-0:5.1.20-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-0:5.1.20-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-0:5.1.20-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debuginfo-0:5.1.20-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debuginfo-0:5.1.20-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debuginfo-0:5.1.20-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debuginfo-0:5.1.20-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debugsource-0:5.1.20-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debugsource-0:5.1.20-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debugsource-0:5.1.20-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-debugsource-0:5.1.20-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-devel-0:5.1.20-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-devel-0:5.1.20-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-devel-0:5.1.20-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-apcu-devel-0:5.1.20-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-0:2.0.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-0:2.0.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-0:2.0.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-0:2.0.3-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-0:2.0.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debuginfo-0:2.0.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-rrd-debugsource-0:2.0.3-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-0:3.1.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-0:3.1.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-0:3.1.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-0:3.1.2-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-0:3.1.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debuginfo-0:3.1.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debuginfo-0:3.1.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debuginfo-0:3.1.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debuginfo-0:3.1.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debugsource-0:3.1.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debugsource-0:3.1.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debugsource-0:3.1.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-xdebug3-debugsource-0:3.1.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-0:1.19.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-0:1.19.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-0:1.19.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-0:1.19.2-1.module+el8.6.0+13671+84712317.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-0:1.19.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debuginfo-0:1.19.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debuginfo-0:1.19.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debuginfo-0:1.19.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debuginfo-0:1.19.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debugsource-0:1.19.2-1.module+el8.6.0+13671+84712317.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debugsource-0:1.19.2-1.module+el8.6.0+13671+84712317.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debugsource-0:1.19.2-1.module+el8.6.0+13671+84712317.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pecl-zip-debugsource-0:1.19.2-1.module+el8.6.0+13671+84712317.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-pgsql-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-process-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-snmp-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-soap-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.7.0.Z.MAIN:php:8.0:8070020230118114629:ef331662:php-xml-debuginfo-0:8.0.27-1.module+el8.7.0+17863+0ad92cd2.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2022-31628

A vulnerability was found in PHP due to an infinite loop within the phar uncompressor code when processing "quines" gzip files. This vulnerability allows a remote attacker to pass a specially crafted archive to the application, and consume all available system resources, causing a denial of service condition.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 286 products, the same list as for CVE-2022-4900

Threats

Impact Low

CVE-2022-31629

A vulnerability was found in PHP due to the way PHP handles HTTP variable names. It interferes with HTTP variable names that clash with ones that have a specific semantic meaning. This vulnerability allows network and same-site attackers to set a standard insecure cookie in the victim's browser, which is treated as a `__Host-` or `__Secure-` cookie by PHP applications, posing a threat to data integrity.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 286 products, the same list as for CVE-2022-4900

Threats

Impact Moderate

CVE-2022-31630

An out-of-bounds read flaw was found in PHP due to insufficient input validation in the imageloadfont() function. This flaw allows a remote attacker to pass specially crafted data to the web application, trigger an out-of-bounds read error, and read the contents of memory on the system.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 286 products, the same list as for CVE-2022-4900

Threats

Impact Moderate

CVE-2022-31631

A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 286 products, the same list as for CVE-2022-4900

Threats

Impact Moderate

CVE-2022-37454

A flaw was found in the Keccak XKCP SHA-3 reference implementation. The sponge function interface allows partial input data to be processed, and partial output to be produced. When at least one of these has a length of 4294967096 bytes or more, it can result in elimination of cryptographic properties, execution of arbitrary code, or a denial of service.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-680 - Integer Overflow to Buffer Overflow

Affected products

Fixed 286 products, the same list as for CVE-2022-4900

Threats

Impact Moderate

References

37 references

URL	Category
https://access.redhat.com/errata/RHSA-2023:0848	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2133687	external
https://bugzilla.redhat.com/show_bug.cgi?id=2133688	external
https://bugzilla.redhat.com/show_bug.cgi?id=2139280	external
https://bugzilla.redhat.com/show_bug.cgi?id=2140200	external
https://bugzilla.redhat.com/show_bug.cgi?id=2158791	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2022-4900	self
https://bugzilla.redhat.com/show_bug.cgi?id=2179880	external
https://www.cve.org/CVERecord?id=CVE-2022-4900	external
https://nvd.nist.gov/vuln/detail/CVE-2022-4900	external
https://access.redhat.com/security/cve/CVE-2022-31628	self
https://bugzilla.redhat.com/show_bug.cgi?id=2133688	external
https://www.cve.org/CVERecord?id=CVE-2022-31628	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31628	external
https://bugs.php.net/bug.php?id=81726	external
https://access.redhat.com/security/cve/CVE-2022-31629	self
https://bugzilla.redhat.com/show_bug.cgi?id=2133687	external
https://www.cve.org/CVERecord?id=CVE-2022-31629	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31629	external
https://bugs.php.net/bug.php?id=81727	external
https://access.redhat.com/security/cve/CVE-2022-31630	self
https://bugzilla.redhat.com/show_bug.cgi?id=2139280	external
https://www.cve.org/CVERecord?id=CVE-2022-31630	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31630	external
https://bugs.php.net/bug.php?id=81739	external
https://www.php.net/ChangeLog-8.php#8.0.25	external
https://access.redhat.com/security/cve/CVE-2022-31631	self
https://bugzilla.redhat.com/show_bug.cgi?id=2158791	external
https://www.cve.org/CVERecord?id=CVE-2022-31631	external
https://nvd.nist.gov/vuln/detail/CVE-2022-31631	external
https://bugs.php.net/bug.php?id=81740	external
https://access.redhat.com/security/cve/CVE-2022-37454	self
https://bugzilla.redhat.com/show_bug.cgi?id=2140200	external
https://www.cve.org/CVERecord?id=CVE-2022-37454	external
https://nvd.nist.gov/vuln/detail/CVE-2022-37454	external

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2022-31628 (GCVE-0-2022-31628)

Vulnerability from cvelistv5 – Published: 2022-09-28 22:25 – Updated: 2025-05-20 20:24

Title

phar wrapper can occur dos when using quine gzip file

Summary

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Severity

2.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-20 20:24 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

php mitre root Scorecard

References

8 references

URL	Tags
https://bugs.php.net/bug.php?id=81726
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.debian.org/security/2022/dsa-5277	vendor-advisory
https://security.gentoo.org/glsa/202211-03	vendor-advisory
https://security.netapp.com/advisory/ntap-2022120…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 7.4.X , < 7.4.31 (custom) Affected: 8.0.X , < 8.0.24 (custom) Affected: 8.1.X , < 8.1.11 (custom)

Date Public

2022-09-27 00:00

Credits

reported by ohseungju5 at gmail dot com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:25:59.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=81726"
          },
          {
            "name": "FEDORA-2022-0b77fbd9e7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
          },
          {
            "name": "FEDORA-2022-afdea1c747",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
          },
          {
            "name": "FEDORA-2022-f204e1d0ed",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
          },
          {
            "name": "DSA-5277",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5277"
          },
          {
            "name": "GLSA-202211-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202211-03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221209-0001/"
          },
          {
            "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-20T20:24:46.199350Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-20T20:24:57.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "7.4.31",
              "status": "affected",
              "version": "7.4.X",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.24",
              "status": "affected",
              "version": "8.0.X",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.1.X",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "reported by ohseungju5 at gmail dot com"
        }
      ],
      "datePublic": "2022-09-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress \"quines\" gzip files, resulting in an infinite loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-15T00:00:00.000Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://bugs.php.net/bug.php?id=81726"
        },
        {
          "name": "FEDORA-2022-0b77fbd9e7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
        },
        {
          "name": "FEDORA-2022-afdea1c747",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
        },
        {
          "name": "FEDORA-2022-f204e1d0ed",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
        },
        {
          "name": "DSA-5277",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5277"
        },
        {
          "name": "GLSA-202211-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202211-03"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221209-0001/"
        },
        {
          "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11."
        }
      ],
      "source": {
        "advisory": "https://bugs.php.net/bug.php?id=81726",
        "defect": [
          "81726"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "phar wrapper can occur dos when using quine gzip file",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2022-31628",
    "datePublished": "2022-09-28T22:25:09.309Z",
    "dateReserved": "2022-05-25T00:00:00.000Z",
    "dateUpdated": "2025-05-20T20:24:57.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31629 (GCVE-0-2022-31629)

Vulnerability from cvelistv5 – Published: 2022-09-28 22:25 – Updated: 2025-11-04 17:12

Title

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

Summary

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-16 18:53 UTC

CWE

CWE-20 - Improper Input Validation
CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

php mitre root Scorecard

References

14 references

URL	Tags
https://bugs.php.net/bug.php?id=81727
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.debian.org/security/2022/dsa-5277	vendor-advisory
https://security.gentoo.org/glsa/202211-03	vendor-advisory
https://security.netapp.com/advisory/ntap-2022120…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
http://www.openwall.com/lists/oss-security/2024/0…	mailing-list
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 7.4.X , < 7.4.31 (custom) Affected: 8.0.X , < 8.0.24 (custom) Affected: 8.1.X , < 8.1.11 (custom)

Date Public

2022-09-27 00:00

Credits

reported by squarcina at gmail dot com

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-31629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T18:53:33.259759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1284",
                "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T15:05:18.365Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:12:24.069Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=81727"
          },
          {
            "name": "FEDORA-2022-0b77fbd9e7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
          },
          {
            "name": "FEDORA-2022-afdea1c747",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
          },
          {
            "name": "FEDORA-2022-f204e1d0ed",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
          },
          {
            "name": "DSA-5277",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5277"
          },
          {
            "name": "GLSA-202211-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202211-03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221209-0001/"
          },
          {
            "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
          },
          {
            "name": "FEDORA-2024-b46619f761",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
          },
          {
            "name": "FEDORA-2024-39d50cc975",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/"
          },
          {
            "name": "FEDORA-2024-5e8ae0def0",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
          },
          {
            "name": "[oss-security] 20240412 PHP security releases 8.1.28, 8.2.18, \u0026 8.3.6",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "7.4.31",
              "status": "affected",
              "version": "7.4.X",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.24",
              "status": "affected",
              "version": "8.0.X",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.11",
              "status": "affected",
              "version": "8.1.X",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "reported by squarcina at gmail dot com"
        }
      ],
      "datePublic": "2022-09-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim\u0027s browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:26.439Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://bugs.php.net/bug.php?id=81727"
        },
        {
          "name": "FEDORA-2022-0b77fbd9e7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/"
        },
        {
          "name": "FEDORA-2022-afdea1c747",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/"
        },
        {
          "name": "FEDORA-2022-f204e1d0ed",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/"
        },
        {
          "name": "DSA-5277",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2022/dsa-5277"
        },
        {
          "name": "GLSA-202211-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202211-03"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221209-0001/"
        },
        {
          "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
        },
        {
          "name": "FEDORA-2024-b46619f761",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
        },
        {
          "name": "FEDORA-2024-39d50cc975",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/"
        },
        {
          "name": "FEDORA-2024-5e8ae0def0",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
        },
        {
          "name": "[oss-security] 20240412 PHP security releases 8.1.28, 8.2.18, \u0026 8.3.6",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11."
        }
      ],
      "source": {
        "advisory": "https://bugs.php.net/bug.php?id=81727",
        "defect": [
          "81727"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "$_COOKIE names string replacement (. -\u003e _): cookie integrity vulnerabilities",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2022-31629",
    "datePublished": "2022-09-28T22:25:10.116Z",
    "dateReserved": "2022-05-25T00:00:00.000Z",
    "dateUpdated": "2025-11-04T17:12:24.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-31630 (GCVE-0-2022-31630)

Vulnerability from cvelistv5 – Published: 2022-11-14 06:53 – Updated: 2024-08-03 07:26

Title

OOB read due to insufficient input validation in imageloadfont()

Summary

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

CWE-131 - Incorrect Calculation of Buffer Size
CWE-190 - Integer Overflow or Wraparound

Assigner

php mitre root Scorecard

References

1 reference

URL	Tags
https://bugs.php.net/bug.php?id=81739

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 7.4.x , < 7.4.33 (custom) Affected: 8.0.x , < 8.0.25 (custom) Affected: 8.1.x , < 8.1.12 (custom)

Date Public

2022-10-24 06:40

Credits

cmb@php.net cmb@php.net

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.044Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=81739"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "gd"
          ],
          "product": "PHP",
          "repo": "https://github.com/php/php-src",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "7.4.33",
              "status": "affected",
              "version": "7.4.x",
              "versionType": "custom"
            },
            {
              "lessThan": "8.0.25",
              "status": "affected",
              "version": "8.0.x",
              "versionType": "custom"
            },
            {
              "lessThan": "8.1.12",
              "status": "affected",
              "version": "8.1.x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "gd extension"
            }
          ],
          "value": "gd extension"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "cmb@php.net"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "cmb@php.net"
        }
      ],
      "datePublic": "2022-10-24T06:40:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.\u0026nbsp;"
            }
          ],
          "value": "In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.\u00a0"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540 Overread Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131 Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190 Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-02T02:38:25.144Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://bugs.php.net/bug.php?id=81739"
        }
      ],
      "source": {
        "defect": [
          "https://bugs.php.net/bug.php?id=81739"
        ],
        "discovery": "INTERNAL"
      },
      "title": "OOB read due to insufficient input validation in imageloadfont()",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2022-31630",
    "datePublished": "2022-11-14T06:53:06.774Z",
    "dateReserved": "2022-05-25T21:03:32.861Z",
    "dateUpdated": "2024-08-03T07:26:01.044Z",
    "requesterUserId": "520cc88b-a1c8-44f6-9154-21a4d74c769f",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-31631 (GCVE-0-2022-31631)

Vulnerability from cvelistv5 – Published: 2025-02-12 22:10 – Updated: 2025-02-13 16:06

Title

PDO::quote() may return unquoted string

Summary

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-13 16:06 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

php mitre root Scorecard

References

2 references

URL	Tags
https://bugs.php.net/bug.php?id=81740
https://security.netapp.com/advisory/ntap-2023022…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.0.x , < 8.0.27 (semver) Affected: 8.1.x , < 8.1.15 (semver) Affected: 8.2.x , < 8.2.2 (semver)

Date Public

2022-12-19 13:27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-12T23:02:37.689Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20230223-0007/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31631",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-13T16:06:19.759677Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-13T16:06:41.825Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://bugs.php.net/bug.php?id=81740"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "pdo_sqlite",
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.0.27",
              "status": "affected",
              "version": "8.0.x",
              "versionType": "semver"
            },
            {
              "lessThan": "8.1.15",
              "status": "affected",
              "version": "8.1.x",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.2",
              "status": "affected",
              "version": "8.2.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2022-12-19T13:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.\u0026nbsp;\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-12T22:10:45.418Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://bugs.php.net/bug.php?id=81740"
        }
      ],
      "source": {
        "advisory": "https://bugs.php.net/bug.php?id=81740",
        "discovery": "INTERNAL"
      },
      "title": "PDO::quote() may return unquoted string",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2022-31631",
    "datePublished": "2025-02-12T22:10:45.418Z",
    "dateReserved": "2022-05-25T21:03:32.861Z",
    "dateUpdated": "2025-02-13T16:06:41.825Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-37454 (GCVE-0-2022-37454)

Vulnerability from cvelistv5 – Published: 2022-10-21 00:00 – Updated: 2025-05-08 15:03

Summary

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-08 15:03 UTC

CWE

n/a
CWE-190 - Integer Overflow or Wraparound

Assigner

mitre mitre root Scorecard

References

14 references

URL	Tags
https://csrc.nist.gov/projects/hash-functions/sha…
https://mouha.be/sha-3-buffer-overflow/
https://news.ycombinator.com/item?id=33281106
https://github.com/XKCP/XKCP/security/advisories/…
https://lists.debian.org/debian-lts-announce/2022…
https://lists.debian.org/debian-lts-announce/2022…
https://lists.fedoraproject.org/archives/list/pac…
https://www.debian.org/security/2022/dsa-5267
https://www.debian.org/security/2022/dsa-5269
https://lists.fedoraproject.org/archives/list/pac…
https://eprint.iacr.org/2023/331
https://news.ycombinator.com/item?id=35050307
https://security.gentoo.org/glsa/202305-02
https://security.netapp.com/advisory/ntap-2023020…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:29:21.027Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20230203-0001/"
          },
          {
            "name": "https://csrc.nist.gov/projects/hash-functions/sha-3-project",
            "tags": [
              "x_transferred"
            ],
            "url": "https://csrc.nist.gov/projects/hash-functions/sha-3-project"
          },
          {
            "name": "https://mouha.be/sha-3-buffer-overflow/",
            "tags": [
              "x_transferred"
            ],
            "url": "https://mouha.be/sha-3-buffer-overflow/"
          },
          {
            "name": "https://news.ycombinator.com/item?id=33281106",
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=33281106"
          },
          {
            "name": "https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658",
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658"
          },
          {
            "name": "https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html",
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html"
          },
          {
            "name": "https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html",
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/",
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/"
          },
          {
            "name": "https://www.debian.org/security/2022/dsa-5267",
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5267"
          },
          {
            "name": "https://www.debian.org/security/2022/dsa-5269",
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2022/dsa-5269"
          },
          {
            "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/",
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://eprint.iacr.org/2023/331"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=35050307"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-37454",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:03:12.969240Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T15:03:28.946Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "unknown",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-03T10:06:29.726Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "https://csrc.nist.gov/projects/hash-functions/sha-3-project",
          "url": "https://csrc.nist.gov/projects/hash-functions/sha-3-project"
        },
        {
          "name": "https://mouha.be/sha-3-buffer-overflow/",
          "url": "https://mouha.be/sha-3-buffer-overflow/"
        },
        {
          "name": "https://news.ycombinator.com/item?id=33281106",
          "url": "https://news.ycombinator.com/item?id=33281106"
        },
        {
          "name": "https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658",
          "url": "https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658"
        },
        {
          "name": "https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html",
          "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html"
        },
        {
          "name": "https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html",
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/"
        },
        {
          "name": "https://www.debian.org/security/2022/dsa-5267",
          "url": "https://www.debian.org/security/2022/dsa-5267"
        },
        {
          "name": "https://www.debian.org/security/2022/dsa-5269",
          "url": "https://www.debian.org/security/2022/dsa-5269"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/"
        },
        {
          "url": "https://eprint.iacr.org/2023/331"
        },
        {
          "url": "https://news.ycombinator.com/item?id=35050307"
        },
        {
          "url": "https://security.gentoo.org/glsa/202305-02"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-37454",
    "datePublished": "2022-10-21T00:00:00.000Z",
    "dateReserved": "2022-08-07T00:00:00.000Z",
    "dateUpdated": "2025-05-08T15:03:28.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-4900 (GCVE-0-2022-4900)

Vulnerability from cvelistv5 – Published: 2023-11-02 15:01 – Updated: 2025-11-03 21:46

Title

Potential buffer overflow in php_cli_server_startup_workers

Summary

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

redhat redhat root Scorecard

References

4 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2022-4900	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2179880	issue-trackingx_refsource_REDHAT
https://security.netapp.com/advisory/ntap-2023113…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

7 products

Vendor	Product	Version
n/a	php	Unaffected: 8.0.22
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Software Collections	cpe:/a:redhat:rhel_software_collections:3
Fedora	Fedora

Date Public

2022-07-13 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:46:48.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-4900"
          },
          {
            "name": "RHBZ#2179880",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179880"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20231130-0008/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "php",
          "vendor": "n/a",
          "versions": [
            {
              "status": "unaffected",
              "version": "8.0.22"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "php",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "php",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "php:7.4/php",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "php:8.0/php",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "php",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "php:8.1/php",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_software_collections:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rh-php73-php",
          "product": "Red Hat Software Collections",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://packages.fedoraproject.org/",
          "defaultStatus": "affected",
          "packageName": "php",
          "product": "Fedora",
          "vendor": "Fedora"
        }
      ],
      "datePublic": "2022-07-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-30T22:06:21.070Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2022-4900"
        },
        {
          "name": "RHBZ#2179880",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179880"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20231130-0008/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-01-31T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2022-07-13T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Potential buffer overflow in php_cli_server_startup_workers",
      "x_redhatCweChain": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-4900",
    "datePublished": "2023-11-02T15:01:28.590Z",
    "dateReserved": "2023-01-31T10:50:33.011Z",
    "dateUpdated": "2025-11-03T21:46:48.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2023_0848

CVE-2022-31628 (GCVE-0-2022-31628)

CVE-2022-31629 (GCVE-0-2022-31629)

CVE-2022-31630 (GCVE-0-2022-31630)

CVE-2022-31631 (GCVE-0-2022-31631)

CVE-2022-37454 (GCVE-0-2022-37454)

CVE-2022-4900 (GCVE-0-2022-4900)

Tags

Sightings

Nomenclature

Related by attack behaviour