{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2024-2408", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "state": "PUBLISHED", "assignerShortName": "php", "dateReserved": "2024-03-12T21:18:50.326Z", "datePublished": "2024-06-09T19:55:51.625Z", "dateUpdated": "2024-08-01T19:11:53.465Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["openssl"], "product": "PHP", "programRoutines": [{"name": "openssl_private_decrypt"}], "repo": "https://github.com/php/php-src", "vendor": "PHP Group", "versions": [{"lessThan": "8.1.29", "status": "affected", "version": "8.1.*", "versionType": "semver"}, {"lessThan": "8.2.20", "status": "affected", "version": "8.2.*", "versionType": "semver"}, {"lessThan": "8.3.8", "status": "affected", "version": "8.3.*", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Hubert Kario"}], "datePublic": "2024-06-09T19:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: var(--wht);\">The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/openssl/openssl/pull/13817\">https://github.com/openssl/openssl/pull/13817</a><span style=\"background-color: var(--wht);\"> (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.<br><br></span>PHP Windows builds for the versions&nbsp;8.1.29,&nbsp;8.2.20 and&nbsp;8.3.8 and above include OpenSSL patches that fix the vulnerability.&nbsp;<br><br>"}], "value": "The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\n\nPHP Windows builds for the versions\u00a08.1.29,\u00a08.2.20 and\u00a08.3.8 and above include OpenSSL patches that fix the vulnerability."}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2024-06-09T19:55:51.625Z"}, "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use a recent patched version of OpenSSL.&nbsp;"}], "value": "Use a recent patched version of OpenSSL."}], "source": {"advisory": "GHSA-hh26-4ppw-5864", "discovery": "UNKNOWN"}, "title": "PHP is vulnerable to the Marvin Attack", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "php", "product": "php", "cpes": ["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "8.1.0", "status": "affected", "lessThan": "8.1.29", "versionType": "semver"}, {"version": "8.2.0", "status": "affected", "lessThan": "8.2.20", "versionType": "semver"}, {"version": "8.3.0", "status": "affected", "lessThan": "8.3.8", "versionType": "semver"}]}, {"vendor": "fedoraproject", "product": "fedora", "cpes": ["cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "40", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-10T19:25:35.228240Z", "id": "CVE-2024-2408", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-30T19:58:20.200Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.465Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:11:53.465Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2408", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-10T19:25:35.228240Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"], "vendor": "php", "product": "php", "versions": [{"status": "affected", "version": "8.1.0", "lessThan": "8.1.29", "versionType": "semver"}, {"status": "affected", "version": "8.2.0", "lessThan": "8.2.20", "versionType": "semver"}, {"status": "affected", "version": "8.3.0", "lessThan": "8.3.8", "versionType": "semver"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*"], "vendor": "fedoraproject", "product": "fedora", "versions": [{"status": "affected", "version": "40"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T19:42:16.117Z"}}], "cna": {"title": "PHP is vulnerable to the Marvin Attack", "source": {"advisory": "GHSA-hh26-4ppw-5864", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Hubert Kario"}], "affected": [{"repo": "https://github.com/php/php-src", "vendor": "PHP Group", "modules": ["openssl"], "product": "PHP", "versions": [{"status": "affected", "version": "8.1.*", "lessThan": "8.1.29", "versionType": "semver"}, {"status": "affected", "version": "8.2.*", "lessThan": "8.2.20", "versionType": "semver"}, {"status": "affected", "version": "8.3.*", "lessThan": "8.3.8", "versionType": "semver"}], "defaultStatus": "affected", "programRoutines": [{"name": "openssl_private_decrypt"}]}], "solutions": [{"lang": "en", "value": "Use a recent patched version of OpenSSL.", "supportingMedia": [{"type": "text/html", "value": "Use a recent patched version of OpenSSL.&nbsp;", "base64": false}]}], "datePublic": "2024-06-09T19:00:00.000Z", "references": [{"url": "https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\n\nPHP Windows builds for the versions\u00a08.1.29,\u00a08.2.20 and\u00a08.3.8 and above include OpenSSL patches that fix the vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: var(--wht);\">The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/openssl/openssl/pull/13817\">https://github.com/openssl/openssl/pull/13817</a><span style=\"background-color: var(--wht);\"> (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.<br><br></span>PHP Windows builds for the versions&nbsp;8.1.29,&nbsp;8.2.20 and&nbsp;8.3.8 and above include OpenSSL patches that fix the vulnerability.&nbsp;<br><br>", "base64": false}]}], "providerMetadata": {"orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php", "dateUpdated": "2024-06-09T19:55:51.625Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2408", "state": "PUBLISHED", "dateUpdated": "2024-08-01T19:11:53.465Z", "dateReserved": "2024-03-12T21:18:50.326Z", "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "datePublished": "2024-06-09T19:55:51.625Z", "assignerShortName": "php"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "7DC2EEF8-834B-42A1-8DA3-0C2CF22A7070", "versionEndExcluding": "8.1.29", "versionStartIncluding": "8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "A39988FF-D854-4277-9D66-6911AF371DD3", "versionEndExcluding": "8.2.20", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "matchCriteriaId": "F579FFC1-4F81-4755-B14B-3AA73AC9FF7A", "versionEndExcluding": "8.3.8", "versionStartIncluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*", "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\n\nPHP Windows builds for the versions\u00a08.1.29,\u00a08.2.20 and\u00a08.3.8 and above include OpenSSL patches that fix the vulnerability."}, {"lang": "es", "value": "La funci\u00f3n openssl_private_decrypt en PHP, cuando se usa el relleno PKCS1 (OPENSSL_PKCS1_PADDING, que es el valor predeterminado), es vulnerable al ataque Marvin a menos que se use con una versi\u00f3n de OpenSSL que incluya los cambios de esta solicitud de extracci\u00f3n: https://github.com/ openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). Estos cambios son parte de OpenSSL 3.2 y tambi\u00e9n se han adaptado a versiones estables de varias distribuciones de Linux, as\u00ed como a las compilaciones de PHP proporcionadas para Windows desde la versi\u00f3n anterior. Todos los distribuidores y constructores deben asegurarse de que esta versi\u00f3n se utilice para evitar que PHP sea vulnerable. Las compilaciones PHP de Windows para las versiones 8.1.29, 8.2.20 y 8.3.8 y superiores incluyen parches OpenSSL que corrigen la vulnerabilidad."}], "id": "CVE-2024-2408", "lastModified": "2024-06-13T04:15:16.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-06-09T20:15:09.270", "references": [{"source": "security@php.net", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864"}, {"source": "security@php.net", "tags": ["Third Party Advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"}, {"source": "security@php.net", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"}], "sourceIdentifier": "security@php.net", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "php: potential exposure to Marvin attack via unsafe implementation of RSA decryption API", "id": "2270358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270358"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-208->CWE-327->CWE-385", "details": ["The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\nPHP Windows builds for the versions\u00a08.1.29,\u00a08.2.20 and\u00a08.3.8 and above include OpenSSL patches that fix the vulnerability.", "The RSA decryption implementation using PKCS#1 v1.5 padding in OpenSSL is vulnerable to a timing side-channel attack known as the Marvin Attack. This vulnerability arises because the execution time of the openssl_private_decrypt() function in PHP with OpenSSL varies based on whether a valid message is returned. This flaw allows an attacker to use these timing differences to decrypt captured ciphertexts or forge signatures, compromising the security of the encrypted data. \nThe vulnerability has been demonstrated through statistical analysis of execution times, confirming the presence of a side channel that can be leveraged in a Bleichenbacher-style attack."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-2408", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "php", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "php:7.4/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "php:8.0/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "php:8.1/php", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "php:8.2/php", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-06-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-2408\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-2408\nhttps://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864"], "statement": "The severity of this vulnerability is considered Moderate rather than Important due to the specific conditions required for exploitation and the complexity involved in executing the attack. While the timing side-channel can potentially be used to decrypt ciphertexts or forge signatures, it necessitates a high degree of precision and a large number of measurements to discern the timing differences accurately. Additionally, the attack requires the ability to send numerous crafted ciphertexts to the decryption function and accurately measure the response times, which might not be feasible in all environments. Therefore, while the vulnerability poses a real threat, its practical exploitation is significantly constrained by these technical challenges.", "threat_severity": "Moderate", "upstream_fix": "php 8.2.12"}