5.5
CVSSv3

CVE-2022-31628

Published: 28/09/2022 Updated: 07/11/2023
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 0

Vulnerability Summary

In PHP versions prior to 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

php php

fedoraproject fedora 35

fedoraproject fedora 36

fedoraproject fedora 37

debian debian linux 10.0

debian debian linux 11.0

Vendor Advisories

Debian Bug report logs - #1021138 php81: CVE-2022-31628 CVE-2022-31629 Package: src:php81; Maintainer for src:php81 is Debian PHP Maintainers <team+pkg-php@trackerdebianorg>; Reported by: Moritz Mühlenhoff <jmm@inutilorg> Date: Sun, 2 Oct 2022 18:15:04 UTC Severity: grave Tags: security, upstream Found in ve ...
Several security issues were fixed in PHP ...
Synopsis Moderate: php:80 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the php:80 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...
Synopsis Moderate: php:81 security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the php:81 module is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...
Multiple security issues were discovered in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, insecure cooking handling or potentially the execution of arbitrary code For the stable distribution (bullseye), these problems have been fixed in version 7433-1+deb11u1 W ...
In PHP versions before 7431, 8024 and 8111, the phar uncompressor code would recursively uncompress quines gzip files, resulting in an infinite loop (CVE-2022-31628) In PHP versions before 7431, 8024 and 8111, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is tr ...
DescriptionThe MITRE CVE dictionary describes this issue as: In PHP versions before 7431, 8024 and 8111, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop ...
ALAS-2022-243 Amazon Linux 2022 Security Advisory: ALAS-2022-243 Advisory Release Date: 2022-12-06 16:44 Pacific ...
PAN-SA-2024-0001 Informational Bulletin: Impact of OSS CVEs in PAN-OS ...

Github Repositories

Jihwan Kim Contact If you want to contact me, please contact with E-mail : payload@kaistackr Researches [MobiSys] HearMeOut: Detecting Voice Phishing Activities in Android Education MS Student at KAIST WSP Lab BS in Computer Science (minor in Industridal Design) at KAIST Graduated Busan Science High School Contributes Content Security Policy Level 3 Do not check c