DEBIAN-CVE-2022-31628

DEBIAN-CVE-2022-31628 PUBLISHED CVSS 5.5 MEDIUM

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

Risk Scores

CVSS v3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Debian:11	php7.4	0, 7.4.21-1, 7.4.25-1

Timeline

Sep 28, 2022 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2022-31628 advisory

Open in Interactive Console →