CVE-2022-36937: Critical severity facebook hiphop virtual machine vulnerability
HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.
Applications that call streamsocketserver or streamsocketclient functions with a URL starting with tls:// are affected.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-36937?
CVE-2022-36937 is a vulnerability in HHVM (HipHop Virtual Machine) versions 4.172.0 and all prior versions that use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension.
What is the severity of CVE-2022-36937?
The severity of CVE-2022-36937 is critical, with a CVSS base score of 9.8.
How does TLS 1.0 affect HHVM?
TLS 1.0 poses a security risk for HHVM as it has numerous published vulnerabilities and is deprecated.
Which versions of HHVM are affected by CVE-2022-36937?
HHVM versions 4.172.0 and all prior versions are affected by CVE-2022-36937.
How can I mitigate CVE-2022-36937?
To mitigate CVE-2022-36937, upgrade your HHVM installation to version 4.153.4 or higher, which replaces TLS 1.0 with TLS 1.3.