CVE-2022-31629

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.(CVE-2022-31629)

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.(CVE-2022-31628)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.(CVE-2022-31629)

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.(CVE-2022-31628)

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.(CVE-2022-31629)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)

• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.2 Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)

• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)

• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)

• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)

• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0). (BZ#2161666)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667)

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a __Host- or __Secure- cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631)
• php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (8.1.14).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.33).

Security Fix(es):

• XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454)
• php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications (CVE-2022-31629)
• php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630)
• php: PDO::quote() may return unquoted string due to an integer overflow (CVE-2022-31631)
• php: phar: infinite loop when decompressing quine gzip file (CVE-2022-31628)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: 1-byte array overrun in common path resolve code (CVE-2023-0568)
• php: Password_verify() always return true with some hash (CVE-2023-0567)
• php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247)
• php: XML loading external entity without being enabled (CVE-2023-3823)
• php: phar Buffer mismanagement (CVE-2023-3824)
• php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756)
• php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096)
• php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)
• php: Erroneous parsing of multipart form data (CVE-2024-8925)
• php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927)
• php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2022-31628.patch: Fix potential infinite recursion in phar wrapper when using quine gzip file
  • CVE-2022-31628
• SECURITY UPDATE: Cookie injection
  • debian/patches/CVE-2022-31629.patch: Add cookie integrity validation
  • CVE-2022-31629
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-31631.patch: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  • CVE-2022-31631

• CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
• CVE-2022-31629: Add cookie integrity validation
• CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string

• CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
• CVE-2022-31629: Add cookie integrity validation
• CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string

• SECURITY UPDATE: possible insecure cookie abuse
  • debian/patches/php-7.3-CVE-2024-2756.patch: fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
  • CVE-2024-2756

• SECURITY UPDATE: possible insecure cookie abuse
  • debian/patches/php-7.3-CVE-2024-2756.patch: fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
  • CVE-2024-2756

• CVE-2022-31629: Add cookie integrity validation
• CVE-2024-2756: Move cookie integrity validation downwards

• CVE-2022-31629: Add cookie integrity validation
• CVE-2024-2756: Move cookie integrity validation downwards

• CVE-2024-2756: Fix issue introduced by incomplete fix of CVE-2022-31629 to prevent network and same-site attackers from setting insecure cookies in victim's browser
• CVE-2024-3096: Fix issue where password_verify() incorrectly returns true when testing a blank string with password starting with a null byte

• CVE-2022-31629: Add cookie integrity validation
• CVE-2024-2756: Fix issue introduced by incomplete fix of CVE-2022-31629 to prevent network and same-site attackers from setting insecure cookies in victim's browser
• CVE-2024-3096: Fix issue where password_verify() incorrectly returns true when testing a blank string with password starting with a null byte

• CVE-2024-2756: Fix issue introduced by incomplete fix of CVE-2022-31629 to prevent network and same-site attackers from setting insecure cookies in victim's browser
• CVE-2024-3096: Fix issue where password_verify() incorrectly returns true when testing a blank string with password starting with a null byte

• CVE-2024-2756: fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

• CVE-2021-21707: fix NUL byte truncation in XML/DOM URI file loading
• CVE-2022-31628: fix phar wrapper denial of service when loading compressed quine archives
• CVE-2022-31629: discard HTTP variables that mangle into __Host- or __Secure- prefixes

Core Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function) Fixed bug GH-9361 (Segmentation fault on script exit #9379). Fixed bug GH-9407 (LSP error in eval'd code refers to wrong class for static type). Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629)

DOM Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).

FPM Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to error_log after daemon reload). Fixed bug #77780 ("Headers already sent..." when previous connection was aborted).

GMP Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed to gmp_init()).

Intl Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).

Phar Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)

PDO_PGSQL Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).

Reflection Fixed bug GH-8932 (ReflectionFunction provides no way to get the called class of a Closure). Fixed bug GH-9409 (Private method is incorrectly dumped as "overwrites").

Streams Fixed bug GH-9316 ($http_response_header is wrong for long status line).

These are all security issues fixed in the php8-8.3.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for php8 fixes the following issues:

• php8 was updated to version 8.0.24
• php8 was updated to version 8.0.23 (jsc#SLE-23639).
• CVE-2021-21703: Fixed a local privilege escalation via PHP-FPM. (bsc#1192050)
• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)
• Fixed missing devel package requires pear and pecl extensions (jsc#SLE-24723, bsc#1200772).

This update for php7 fixes the following issues:

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php72 fixes the following issues:

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)
• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)