CVE-2022-31626: mysqlnd/pdo password buffer overflow
Fixed bug : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
Other sources
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdomysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31626?
CVE-2022-31626 is a vulnerability in PHP that allows a buffer overflow when using the pdo_mysql extension with the mysqlnd driver and allowing a third party to supply the host and password for the connection.
How does CVE-2022-31626 affect PHP?
CVE-2022-31626 affects PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7.
What is the severity of CVE-2022-31626?
CVE-2022-31626 has a severity value of 8.8, which is considered high.
How can I fix CVE-2022-31626?
To fix CVE-2022-31626, upgrade PHP to version 7.4.30, 8.0.20, or 8.1.7.
Where can I find more information about CVE-2022-31626?
You can find more information about CVE-2022-31626 on the official PHP bug report (https://bugs.php.net/bug.php?id=81719) and the Debian and Fedora project announcements (https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html, https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/).