CVE-2022-31628CWE-674

phar wrapper can occur dos when using quine gzip file

Low · published September 28, 2022

CVSS v3.1
2.3
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.

The record
Technical detail
CVSS v3.1
2.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00628 · 49.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2022-09-28T22:25Z
EPSS history
Timeline
  • 28 SEP 22:25Z
    phar wrapper can occur dos when using quine gzip file
    cvelistv5