CVE-2022-31629: $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
$COOKIE names string replacement (. -> ): cookie integrity vulnerabilities
Other sources
Fixed bug GHSA-wpj3-hf5j-x4v4 (Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
— PHP
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
alpine/php7to a version that resolves this vulnerability.Fixed in 7.4.32-r0 - Upgrade
Upgrade
alpine/php8to a version that resolves this vulnerability.Fixed in 8.0.24-r0 - Upgrade
Upgrade
alpine/php8to a version that resolves this vulnerability.Fixed in 8.0.25-r0 - Upgrade
Upgrade
alpine/php81to a version that resolves this vulnerability.Fixed in 8.1.11-r0 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.31 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.0.25 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.4.31 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.0.24 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.11
Event History
Frequently Asked Questions
What is CVE-2022-31629?
CVE-2022-31629 is a vulnerability in PHP versions before 7.4.31, 8.0.24, and 8.1.11 that enables network and same-site attackers to set an insecure cookie in the victim's browser.
How does CVE-2022-31629 affect PHP?
CVE-2022-31629 affects PHP versions before 7.4.31, 8.0.24, and 8.1.11 by allowing attackers to set a standard insecure cookie in the victim's browser.
How can I fix CVE-2022-31629 in PHP?
To fix CVE-2022-31629 in PHP, update to version 7.4.32, 7.3.31-1~deb10u4, or 7.4.33-1+deb11u3 (or later versions).
What are the details of CVE-2022-31629?
CVE-2022-31629 allows network and same-site attackers to set a standard insecure cookie in the victim's browser, which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
Where can I find more information about CVE-2022-31629?
You can find more information about CVE-2022-31629 at the following references: [Link 1](https://www.php.net/ChangeLog-7.php#7.4.32), [Link 2](https://bugs.php.net/bug.php?id=81727), [Link 3](https://github.com/php/php-src/commit/0611be4e82887cee0de6c4cbae320d34eec946ca)