CVE-2022-31628: phar wrapper can occur dos when using quine gzip file
Published Sep 28, 2022
·Updated
Fixed bug : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
Other sources
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
— Launchpad
phar wrapper can occur dos when using quine gzip file
— Microsoft
Affected Software
11 affected componentsFixes available
PHP PHP<8.0.24
8.0.24
debian/php7.4
7.4.33-1+deb11u57.4.33-1+deb11u8
PHP PHP<7.4.31
PHP PHP>=8.0.0<8.0.24
PHP PHP>=8.1.0<8.1.11
Fedoraproject Fedora=35
Fedoraproject Fedora=36
Fedoraproject Fedora=37
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Microsoft cbl2 php
Remediation
Information
Upgrade to PHP 7.4.31, 8.0.24, or 8.1.11.
Event History
Sep 28, 2022
CVE Published
via MITRE·10:25 PM
Data Sourced
via MITRE·10:25 PM
RemedyDescriptionSeverityWeakness
Jan 12, 2024
Data Sourced
via Launchpad·06:02 PM
Description
Sep 20, 2024
Data Sourced
via Ubuntu·06:41 PM
RemedyDescriptionSeverityAffected Software
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity