Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2024-2408 | First vendor Publication | 2024-06-09 |
Vendor | Cve | Last vendor Modification | 2024-06-13 |
Security-Database Scoring CVSS v3
Cvss vector : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N | |||
---|---|---|---|
Overall CVSS Score | 5.9 | ||
Base Score | 5.9 | Environmental Score | 5.9 |
impact SubScore | 3.6 | Temporal Score | 5.9 |
Exploitabality Sub Score | 2.2 | ||
Attack Vector | Network | Attack Complexity | High |
Privileges Required | None | User Interaction | None |
Scope | Unchanged | Confidentiality Impact | High |
Integrity Impact | None | Availability Impact | None |
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : | |||
---|---|---|---|
Cvss Base Score | N/A | Attack Range | N/A |
Cvss Impact Score | N/A | Attack Complexity | N/A |
Cvss Expoit Score | N/A | Authentication | N/A |
Calculate full CVSS 2.0 Vectors scores |
Detail
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2408 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-203 | Information Exposure Through Discrepancy |
CPE : Common Platform Enumeration
Sources (Detail)
Alert History
Date | Informations |
---|---|
2024-08-02 13:55:47 |
|
2024-08-02 01:35:10 |
|
2024-06-13 09:27:26 |
|
2024-06-13 02:44:21 |
|
2024-06-13 02:43:56 |
|
2024-06-12 21:27:27 |
|
2024-06-12 09:27:25 |
|
2024-06-10 09:27:23 |
|
2024-06-10 00:27:23 |
|