Fluid Attacks Database

Description

Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	php8.2	=8.2.10-1 \|\| =8.2.10-2 \|\| =8.2.12-1 \|\| =8.2.16-1 \|\| =8.2.16-2 \|\| =8.2.17-1 \|\| =8.2.5-2 \|\| =8.2.7-1 \|\| =8.2.7-1.1 \|\| =8.2.7-1.2 \|\| =8.2.7-1~deb12u1 \|\| >=0 <8.2.18-1~deb12u1	8.2.18-1~deb12u1
rpm rhel7	php	-	-
rpm rhel9	php	<0:8.0.30-2.el9	0:8.0.30-2.el9
rpm rhel8	php	<0:7.4.33-2.module+el8.10.0+22485+a3539972	0:7.4.33-2.module+el8.10.0+22485+a3539972
rpm rhel6	php	-	-
packagist	php	>=8.1.0 <8.1.28 \|\| >=8.2.0 <8.2.18 \|\| >=8.3.0 <8.3.5	8.1.28, 8.2.18, 8.3.5

Aliases

1. CVE-2024-27562. NVD-2024-27563. OSV-DEBIAN-2024-27564. OSV-2024-27565. GCVE-2024-27566. SECURITY-TRACKER-CVE-2024-27567. lists.debian.org8. https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2756.json9. GHSA-wpj3-hf5j-x4v410. security.netapp.com

References

1. http://www.openwall.com/lists/oss-security/2024/04/12/112. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/3. https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.