CVE-2022-31628

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Score

CVSS 3.1 5.5 Medium

Status

Modified - security@php.net

Published

2022-09-28

Last modified

2025-05-20

Weaknesses

CWE-674, CWE-835

Affected products

• Debian Linux (Debian)
• Fedora (Fedoraproject)
• Php (Php)
• Php (Php Group)

References

• https://bugs.php.net/bug.php?id=81726
• https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVF…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE4…
• https://security.gentoo.org/glsa/202211-03
• https://security.netapp.com/advisory/ntap-20221209-0001/
• https://www.debian.org/security/2022/dsa-5277