Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 877853 (CVE-2022-31630) - <dev-lang/php-{7.4.33,8.0.25,8.1.12}: multiple vulnerabilities
Summary: <dev-lang/php-{7.4.33,8.0.25,8.1.12}: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-31630
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://mouha.be/sha-3-buffer-overflow/
Whiteboard: B2 [glsa+]
Keywords:
Depends on: 879333
Blocks: CVE-2022-37454
  Show dependency tree
 
Reported: 2022-10-21 16:05 UTC by John Helmert III
Modified: 2022-11-22 04:03 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-21 16:05:54 UTC
CVE-2022-37454:

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

URL says PHP is affected, any fix or report upstream?
Comment 1 Brian Evans Gentoo Infrastructure gentoo-dev 2022-10-21 22:18:29 UTC
Will be fixed in the next release
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-22 04:40:38 UTC
Thanks!
Comment 3 Larry the Git Cow gentoo-dev 2022-10-28 18:22:19 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=933e9dbff1dade86d2492c6a6f18dbc69f70caed

commit 933e9dbff1dade86d2492c6a6f18dbc69f70caed
Author:     Brian Evans <grknight@gentoo.org>
AuthorDate: 2022-10-28 18:20:34 +0000
Commit:     Brian Evans <grknight@gentoo.org>
CommitDate: 2022-10-28 18:22:16 +0000

    dev-lang/php: Version bump for 8.1.12
    
    Bug: https://bugs.gentoo.org/877853
    Bug: https://bugs.gentoo.org/878133
    Signed-off-by: Brian Evans <grknight@gentoo.org>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-8.1.12.ebuild | 757 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 758 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7f2e081926e4380728f98037cda3e3b7aaf4410f

commit 7f2e081926e4380728f98037cda3e3b7aaf4410f
Author:     Brian Evans <grknight@gentoo.org>
AuthorDate: 2022-10-28 17:47:34 +0000
Commit:     Brian Evans <grknight@gentoo.org>
CommitDate: 2022-10-28 18:22:16 +0000

    dev-lang/php: Version bump for 8.0.25
    
    Bug: https://bugs.gentoo.org/877853
    Bug: https://bugs.gentoo.org/878133
    Signed-off-by: Brian Evans <grknight@gentoo.org>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-8.0.25.ebuild | 759 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 760 insertions(+)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-30 03:33:37 UTC
Thanks! Please stabilize when ready. Do we know if 7.4 is affected?
Comment 5 Brian Evans Gentoo Infrastructure gentoo-dev 2022-10-30 12:32:15 UTC
(In reply to John Helmert III from comment #4)
> Thanks! Please stabilize when ready. Do we know if 7.4 is affected?

Yes this was applied to the 7.4 branch.  I will wait a few days for a release before localizing these patches into a revbump.
Comment 6 Larry the Git Cow gentoo-dev 2022-11-03 13:02:36 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d9788a266bffae184d77b33abfb39cd38003be75

commit d9788a266bffae184d77b33abfb39cd38003be75
Author:     Brian Evans <grknight@gentoo.org>
AuthorDate: 2022-11-03 13:01:49 +0000
Commit:     Brian Evans <grknight@gentoo.org>
CommitDate: 2022-11-03 13:02:14 +0000

    dev-lang/php: Version bump for 7.4.33
    
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: Brian Evans <grknight@gentoo.org>

 dev-lang/php/Manifest          |   1 +
 dev-lang/php/php-7.4.33.ebuild | 749 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 750 insertions(+)
Comment 7 Larry the Git Cow gentoo-dev 2022-11-18 16:12:07 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=782bbfabc6969db4a521238fa5e5bdc6c295e942

commit 782bbfabc6969db4a521238fa5e5bdc6c295e942
Author:     Brian Evans <grknight@gentoo.org>
AuthorDate: 2022-11-18 16:10:27 +0000
Commit:     Brian Evans <grknight@gentoo.org>
CommitDate: 2022-11-18 16:10:27 +0000

    dev-lang/php: Drop old versions
    
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: Brian Evans <grknight@gentoo.org>

 dev-lang/php/Manifest          |   3 -
 dev-lang/php/php-7.4.32.ebuild | 748 ----------------------------------------
 dev-lang/php/php-8.0.24.ebuild | 758 -----------------------------------------
 dev-lang/php/php-8.1.11.ebuild | 756 ----------------------------------------
 4 files changed, 2265 deletions(-)
Comment 8 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-18 21:15:48 UTC
Added to existing GLSA request.
Comment 9 Larry the Git Cow gentoo-dev 2022-11-22 04:01:23 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=a1c6623b6eaf15e917c58aa4f27b51911625e28f

commit a1c6623b6eaf15e917c58aa4f27b51911625e28f
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-11-19 03:32:18 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-11-22 03:59:39 +0000

    [ GLSA 202211-03 ] PHP: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/867913
    Bug: https://bugs.gentoo.org/873376
    Bug: https://bugs.gentoo.org/877853
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202211-03.xml | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
Comment 10 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-22 04:03:14 UTC
GLSA released, all done!