Описание
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocation and subsequently a heap-based buffer overflow, causing memory corruption that later is surfaced as an application abort that results in a denial of service.
Отчет
To exploit this issue, an attacker needs to find an application using the AES-WRAP-PAD algorithm. This algorithm is rarely used, limiting the exposure of this vulnerability. Additionally, the memory allocator can detect the heap-based buffer overflow and will abort the process with no other security impact. For these reasons, this issue has been rated with a moderate severity.
Меры по смягчению последствий
To mitigate this vulnerability, do not use the AES-WRAP-PAD algorithm, by switching to a secure alternative.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | php | Not affected | ||
| Red Hat Enterprise Linux 7 | php | Not affected | ||
| Red Hat Enterprise Linux 9 | php | Fix deferred | ||
| Red Hat Enterprise Linux 9 | php:8.4/php | Not affected | ||
| Red Hat Enterprise Linux 10 | php | Fixed | RHSA-2026:48170 | 29.07.2026 |
| Red Hat Enterprise Linux 10 | php8.4 | Fixed | RHSA-2026:49914 | 04.08.2026 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2026:47749 | 30.07.2026 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2026:47750 | 30.07.2026 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2026:40416 | 16.07.2026 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2026:48197 | 31.07.2026 |
Показывать по
Дополнительная информация
Статус:
5.6 Medium
CVSS3
Связанные уязвимости
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before ...
5.6 Medium
CVSS3