Vulnerability in Php
CVE-2024-2408
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
EPSS: 0.012 (63.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Php
- Php Group — versions 8.1.*, 8.2.*, 8.3.*
- Fedoraproject Fedora — versions 40
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@php.net (Exploit, Third Party Advisory)
- security@php.net (Third Party Advisory)
- security@php.net
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2024-2408?
- CVE-2024-2408 is a medium-severity vulnerability in Php, classified under Observable Discrepancy. CVSS score: 5.9/10. Published 2024-06-09.
- How severe is CVE-2024-2408?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2024-2408 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.