CVE-2022-31629

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31629
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31629.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-31629
Aliases
Downstream
ALPINE (1)
ALSA (8)
BELL (1)
CLEANSTART (1)
CLSA (13)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (3)
openSUSE (1)
RHSA (4)
RLSA (4)
SUSE (7)
UBUNTU (1)
Related
ALSA (8)
openSUSE (1)
SUSE (7)
Published
2022-09-28T22:25:10Z
Modified
2026-10-24T10:33:57Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
Details

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

Database specific 
{
    "cna_assigner": "php",
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31629.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "7.4.X"
                        },
                        {
                            "fixed": "7.4.31"
                        },
                        {
                            "introduced": "8.0.X"
                        },
                        {
                            "fixed": "8.0.24"
                        },
                        {
                            "introduced": "8.1.X"
                        },
                        {
                            "fixed": "8.1.11"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d2745768fac5941a8aded96f53c0035d29bbcab
Introduced
5dc92c2117cafc61daaaaa240fd46c3ac33872a4
Fixed
b3034f5d053744d34eab8783d5fde0a5af95a070
Introduced
381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115
Fixed
b357a4fe713d5a8f096f89d30019e5d322711c64
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.4.31"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "fixed": "8.0.24"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "8.1.0"
                },
                {
                    "fixed": "8.1.11"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

Other
POST_64BIT_BRANCH_MERGE
POST_AST_MERGE
POST_PHP7_NSAPI_REMOVAL
POST_PHP7_REMOVALS
POST_PHPNG_MERGE
PRE_64BIT_BRANCH_MERGE
PRE_AST_MERGE
PRE_PHP7_EREG_MYSQL_REMOVALS
PRE_PHP7_NSAPI_REMOVAL
PRE_PHP7_REMOVALS

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-31629.json"