PT-2024-5790 · Php+8 · Php+8

Hubert Kario

+1

·

Published

2023-12-19

·

Updated

2025-08-11

·

CVE-2024-2408

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions PHP versions prior to 8.1.29 PHP versions prior to 8.2.20 PHP versions prior to 8.3.8
Description The issue is related to the openssl private decrypt function in PHP when using PKCS1 padding, which is the default. This makes PHP vulnerable to the Marvin Attack unless used with an OpenSSL version that includes specific changes. The changes are part of OpenSSL 3.2 and have been backported to stable versions of various Linux distributions and PHP builds for Windows.
Recommendations For PHP versions prior to 8.1.29, update to version 8.1.29 or later to include OpenSSL patches that fix the vulnerability. For PHP versions prior to 8.2.20, update to version 8.2.20 or later to include OpenSSL patches that fix the vulnerability. For PHP versions prior to 8.3.8, update to version 8.3.8 or later to include OpenSSL patches that fix the vulnerability.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

Related Identifiers

ALT-PU-2024-13731
ALT-PU-2024-16480
ALT-PU-2024-9191
ALT-PU-2024-9193
AZL-42616
AZL-42628
BDU:2024-06520
BIT-LIBPHP-2024-2408
BIT-PHP-2024-2408
BIT-PHP-MIN-2024-2408
CESA-2023_7877
CVE-2024-2408
GHSA-HH26-4PPW-5864
RHSA-2023:7877
RHSA-2023_7877
USN-6663-1
USN-6663-2
USN-6663-3

Affected Products

Alt Linux
Astra Linux
Centos
Debian
Openssl
Php
Red Hat
Red Os
Rocky Linux