CVE-2023-3247 (Medium) detected in php-srcphp-8.2.4

[mend-bolt-for-github]

CVE-2023-3247 - Medium Severity Vulnerability

Vulnerable Library - php-srcphp-8.2.4

The PHP Interpreter

Library home page: https://github.com/php/php-src.git

Found in base branch: master

Vulnerable Source Files (1)

/ext/soap/php_http.c

Vulnerability Details

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. 

Publish Date: 2023-07-22

URL: CVE-2023-3247

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76gg-c692-v2mw

Release Date: 2023-06-14

Fix Resolution: php-8.0.29,php-8.1.20,php-8.2.7

---

Step up your Open Source Security Game with Mend here