Vulnerability Description
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | >= 7.4.0, < 7.4.30 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://bugs.php.net/bug.php?id=81720ExploitIssue TrackingMailing List
- https://lists.debian.org/debian-lts-announce/2022/12/msg00030.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202209-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220722-0005/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5179Third Party Advisory
- https://bugs.php.net/bug.php?id=81720ExploitIssue TrackingMailing List
- https://lists.debian.org/debian-lts-announce/2022/12/msg00030.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202209-20Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220722-0005/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5179Third Party Advisory
FAQ
What is CVE-2022-31625?
CVE-2022-31625 is a vulnerability with a CVSS score of 8.1 (HIGH). In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting...
How severe is CVE-2022-31625?
CVE-2022-31625 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31625?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php, Debian Debian Linux.