214 lines
8.3 KiB
JSON
214 lines
8.3 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.1",
|
|
"cveMetadata": {
|
|
"state": "PUBLISHED",
|
|
"cveId": "CVE-2022-31626",
|
|
"assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
|
|
"assignerShortName": "php",
|
|
"datePublished": "2022-06-16T05:45:16.880Z",
|
|
"dateUpdated": "2024-09-17T03:38:54.950Z",
|
|
"dateReserved": "2022-05-25T00:00:00.000Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "mysqlnd/pdo password buffer overflow",
|
|
"datePublic": "2022-06-06T00:00:00.000Z",
|
|
"providerMetadata": {
|
|
"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
|
|
"shortName": "php",
|
|
"dateUpdated": "2022-12-15T00:00:00.000Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "PHP Group",
|
|
"product": "PHP",
|
|
"versions": [
|
|
{
|
|
"version": "7.4.X",
|
|
"status": "affected",
|
|
"lessThan": "7.4.30",
|
|
"versionType": "custom"
|
|
},
|
|
{
|
|
"version": "8.0.X",
|
|
"status": "affected",
|
|
"lessThan": "8.0.20",
|
|
"versionType": "custom"
|
|
},
|
|
{
|
|
"version": "8.1.X",
|
|
"status": "affected",
|
|
"lessThan": "8.1.7",
|
|
"versionType": "custom"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://bugs.php.net/bug.php?id=81719"
|
|
},
|
|
{
|
|
"name": "FEDORA-2022-0a96e5b9b1",
|
|
"tags": [
|
|
"vendor-advisory"
|
|
],
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/"
|
|
},
|
|
{
|
|
"name": "FEDORA-2022-f3fc52428e",
|
|
"tags": [
|
|
"vendor-advisory"
|
|
],
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/"
|
|
},
|
|
{
|
|
"name": "DSA-5179",
|
|
"tags": [
|
|
"vendor-advisory"
|
|
],
|
|
"url": "https://www.debian.org/security/2022/dsa-5179"
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20220722-0005/"
|
|
},
|
|
{
|
|
"name": "GLSA-202209-20",
|
|
"tags": [
|
|
"vendor-advisory"
|
|
],
|
|
"url": "https://security.gentoo.org/glsa/202209-20"
|
|
},
|
|
{
|
|
"name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
|
|
"tags": [
|
|
"mailing-list"
|
|
],
|
|
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "c dot fol at ambionics dot io"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"type": "CWE",
|
|
"lang": "en",
|
|
"description": "CWE-120 Buffer Overflow",
|
|
"cweId": "CWE-120"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"x_generator": {
|
|
"engine": "Vulnogram 0.0.9"
|
|
},
|
|
"source": {
|
|
"defect": [
|
|
"https://bugs.php.net/bug.php?id=81719"
|
|
],
|
|
"discovery": "EXTERNAL"
|
|
},
|
|
"configurations": [
|
|
{
|
|
"lang": "en",
|
|
"value": "pgsql extension enabled"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2024-08-03T07:26:00.678Z"
|
|
},
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://bugs.php.net/bug.php?id=81719",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"name": "FEDORA-2022-0a96e5b9b1",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_transferred"
|
|
],
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/"
|
|
},
|
|
{
|
|
"name": "FEDORA-2022-f3fc52428e",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_transferred"
|
|
],
|
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/"
|
|
},
|
|
{
|
|
"name": "DSA-5179",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_transferred"
|
|
],
|
|
"url": "https://www.debian.org/security/2022/dsa-5179"
|
|
},
|
|
{
|
|
"url": "https://security.netapp.com/advisory/ntap-20220722-0005/",
|
|
"tags": [
|
|
"x_transferred"
|
|
]
|
|
},
|
|
{
|
|
"name": "GLSA-202209-20",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_transferred"
|
|
],
|
|
"url": "https://security.gentoo.org/glsa/202209-20"
|
|
},
|
|
{
|
|
"name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
|
|
"tags": [
|
|
"mailing-list",
|
|
"x_transferred"
|
|
],
|
|
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
} |