Infinite Loop Vulnerability in PHP Packages: CVE-2022-31628
Summary
UBUNTU-CVE-2022-31628: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. Affects php5 versions 5.5.3+dfsg-1ubuntu2 – 5.5.9+dfsg-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected packages include various versions of PHP, specifically php5, php7.0, php7.2, php7.4, and php8.1, which are integral for running PHP applications on Ubuntu systems. This vulnerability allows for recursive uncompression of 'quines' gzip files, leading to potential denial of service through infinite loops.
Vulnerability Detail
The vulnerability, identified as CVE-2022-31628, arises from the phar uncompressor code in PHP versions prior to 7.4.31, 8.0.24, and 8.1.11. It allows attackers to exploit the uncompression process of specially crafted gzip files, resulting in an infinite loop. This could lead to resource exhaustion, causing the application to become unresponsive and potentially impacting the availability of services relying on PHP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted gzip files with the phar uncompressor until the packages are updated. This can help mitigate the risk of triggering the infinite loop.
Conclusion
CVE-2022-31628 represents a significant vulnerability in multiple PHP packages that can lead to denial of service through infinite loops. It is crucial for users to update their PHP installations to the patched versions to mitigate this risk.
See every vulnerability recorded for php5 →
FAQ
CVE-2022-31628 is a vulnerability in PHP that allows for infinite loops when processing certain gzip files, potentially leading to denial of service.
The affected versions include PHP versions before 7.4.31, 8.0.24, and 8.1.11.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to resource exhaustion, causing applications to become unresponsive and affecting service availability.
Yes, patches are available for the affected PHP versions. Updating to the specified patched versions will resolve the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
