CVE-2022-24953: Crypt_GPG does not prevent additional options in GPG calls
CryptGPG does not prevent additional options in GPG calls
Other sources
The CryptGPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pear/crypt_gpgto a version that resolves this vulnerability.Fixed in 1.6.7 - Upgrade
Upgrade
debian/php-crypt-gpgto a version that resolves this vulnerability.Fixed in 1.6.7-2Fixed in 1.6.11-1Fixed in 2.0.0-2 - Upgrade
Upgrade
debian/php-crypt-gpgto a version that resolves this vulnerability.Fixed in 1.6.7-1 - Upgrade
Upgrade
Crypt_GPGto a version that resolves this vulnerability.Fixed in 1.6.7
Event History
Frequently Asked Questions
What is CVE-2022-24953?
CVE-2022-24953 is a vulnerability in the Crypt_GPG extension for PHP that allows additional options in GPG calls, posing a risk for certain environments and GPG versions.
What is the severity of CVE-2022-24953?
The severity of CVE-2022-24953 is medium with a CVSS score of 5.3.
How does CVE-2022-24953 affect software?
CVE-2022-24953 affects the Crypt_GPG extension before version 1.6.7 for PHP.
How can CVE-2022-24953 be fixed?
To fix CVE-2022-24953, upgrade to version 1.6.7 or later of the Crypt_GPG extension for PHP.
Is there any additional information available for CVE-2022-24953?
Yes, you can refer to the following links for more information: [link1](https://github.com/pear/Crypt_GPG/commit/29c0fbe96d0d4063ecd5c9a4644cb65a7fb7cc4e), [link2](https://github.com/pear/Crypt_GPG/commit/74c8f989cefbe0887274b461dc56197e121bfd04)