CVE-2024-2756: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
Host-/Secure- cookie bypass due to partial CVE-2022-31629 fix
Other sources
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications.
— NVD
Due to an incomplete fix to CVE-2022-31629, network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications.
The vulnerability is identical to one previously described in https://bugs.php.net/bug.php?id=81727. Unfortunatly, since CVE-2022-31629 got only partially fixed in PHP >8.1.11, cookies starting with [Host- are parsed by PHP applications as Host-.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/php7.0to a version that resolves this vulnerability.Fixed in 7.0.33-0ubuntu0.16.04.16+ - Upgrade
Upgrade
ubuntu/php7.2to a version that resolves this vulnerability.Fixed in 7.2.24-0ubuntu0.18.04.17+ - Upgrade
Upgrade
ubuntu/php7.4to a version that resolves this vulnerability.Fixed in 7.4.3-4ubuntu2.22 - Upgrade
Upgrade
ubuntu/php8.1to a version that resolves this vulnerability.Fixed in 8.1.2-1ubuntu2.17 - Upgrade
Upgrade
ubuntu/php8.1to a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
ubuntu/php8.2to a version that resolves this vulnerability.Fixed in 8.2.10-2ubuntu2.1 - Upgrade
Upgrade
ubuntu/php8.2to a version that resolves this vulnerability.Fixed in 8.2.18 - Upgrade
Upgrade
ubuntu/php8.3to a version that resolves this vulnerability.Fixed in 8.3.6-0 - Upgrade
Upgrade
ubuntu/php8.3to a version that resolves this vulnerability.Fixed in 8.3.6 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.1.28 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.18 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.3.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.28-1 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.18-1~deb12u1 - Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.32-1~deb12u1Fixed in 8.2.35-1~deb12u1 - Upgrade
Upgrade
alpine/php81to a version that resolves this vulnerability.Fixed in 8.1.28-r0 - Upgrade
Upgrade
alpine/php82to a version that resolves this vulnerability.Fixed in 8.2.18-r0 - Upgrade
Upgrade
alpine/php83to a version that resolves this vulnerability.Fixed in 8.3.6-r0 - Upgrade
Upgrade
alpine/php83to a version that resolves this vulnerability.Fixed in 8.3.5-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch GHSA-wpj3-hf5j-x4v4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2024-2756?
CVE-2024-2756 has been classified as a high severity vulnerability due to the potential for attackers to manipulate cookie handling in PHP applications.
How do I fix CVE-2024-2756?
To fix CVE-2024-2756, upgrade PHP to the latest available version that addresses this vulnerability, such as 8.1.28 or higher.
What versions of PHP are affected by CVE-2024-2756?
CVE-2024-2756 affects multiple PHP versions including 7.0.x, 7.2.x, 7.4.x, 8.1.x, and 8.2.x prior to the respective patched releases.
Is CVE-2024-2756 a result of a previous vulnerability?
Yes, CVE-2024-2756 is an incomplete fix to the previously reported CVE-2022-31629.
Can CVE-2024-2756 be exploited remotely?
Yes, CVE-2024-2756 can potentially be exploited by remote attackers, making it a significant security concern.