CVE-2022-31629

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type

GIT

Repo

https://github.com/php/php-src

Events

Introduced

Fixed

3d2745768fac5941a8aded96f53c0035d29bbcab

Introduced

5dc92c2117cafc61daaaaa240fd46c3ac33872a4

Fixed

b3034f5d053744d34eab8783d5fde0a5af95a070

Introduced

381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115

Fixed

b357a4fe713d5a8f096f89d30019e5d322711c64

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.4.31"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.24"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.11"
        }
    ]
}

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "36"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "37"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31629.json"