CVE-2023-3247
Published: 19 June 2023
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.
Notes
| Author | Note |
|---|---|
| sbeattie | PEAR issues should go against php-pear as of xenial |
| rodrigo-zaiden | the method php_random_bytes_throw that is being used for nonce generation was added in php7.0 with CSPRNG API, so patching versions older than that is not feasible as it would would likely add other issues. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Ignored
(fix not applicable)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
php7.0 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(7.0.33-0ubuntu0.16.04.16+esm7)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
|
php7.2 Launchpad, Ubuntu, Debian |
bionic |
Released
(7.2.24-0ubuntu0.18.04.17+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
php7.4 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Released
(7.4.3-4ubuntu2.19)
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
php8.1 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Released
(8.1.2-1ubuntu2.13)
|
|
| kinetic |
Released
(8.1.7-1ubuntu3.5)
|
|
| lunar |
Released
(8.1.12-1ubuntu4.2)
|
|
| mantic |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(8.1.20)
|
|
| xenial |
Does not exist
|
|
|
php8.2 Launchpad, Ubuntu, Debian |
bionic |
Ignored
(end of standard support)
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| mantic |
Not vulnerable
(8.2.7-1ubuntu1)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Released
(8.2.7-1)
|
|
| xenial |
Ignored
(end of standard support)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 4.3 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | Low |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
References
- https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw
- https://github.com/php/php-src/commit/ac4254ad764c70cb1f05c9270d8d12689fc3aeb6 (php-8.0.29)
- https://github.com/php/php-src/commit/32c7c433ac1983c4497349051681a4f361d3d33e (php-8.0.29)
- https://ubuntu.com/security/notices/USN-6199-1
- https://ubuntu.com/security/notices/USN-6199-2
- https://www.cve.org/CVERecord?id=CVE-2023-3247
- NVD
- Launchpad
- Debian