The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
Metrics
Affected Vendors & Products
References
History
Mon, 16 Dec 2024 02:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Redhat
Redhat enterprise Linux |
|
CPEs | cpe:/o:redhat:enterprise_linux:8 | |
Vendors & Products |
Redhat
Redhat enterprise Linux |
MITRE
Status: PUBLISHED
Assigner: php
Published: 2024-06-09T19:55:51.625Z
Updated: 2024-08-01T19:11:53.465Z
Reserved: 2024-03-12T21:18:50.326Z
Link: CVE-2024-2408
Vulnrichment
Updated: 2024-08-01T19:11:53.465Z
NVD
Status : Modified
Published: 2024-06-09T20:15:09.270
Modified: 2024-11-21T09:09:41.450
Link: CVE-2024-2408
Redhat