Ubuntu.comUB:CVE-2024-2408CVE-2024-2408
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.3%
The openssl_private_decrypt function in PHP, when using PKCS1 padding
(OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin
Attack unless it is used with an OpenSSL version that includes the changes
from this pull request: https://github.com/openssl/openssl/pull/13817
(rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and
have also been backported to stable versions of various Linux
distributions, as well as to the PHP builds provided for Windows since the
previous release. All distributors and builders should ensure that this
version is used to prevent PHP from being vulnerable.
PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above
include OpenSSL patches that fix the vulnerability.
Notes
| Author | Note |
|---|---|
| mdeslaur | The OpenSSL commit was backported to Ubuntu packages in the following USN: https://ubuntu.com/security/notices/USN-6663-1 As such, I am marking this CVE as not-affected for the releases that have the updated OpenSSL package. |
Related
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.8 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
28.3%