ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| bionic | DNE | |
| esm-infra-legacy/trusty | needed | |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | DNE | |
| trusty | ignored | end of standard support |
| trusty/esm | ignored | end of ESM support, was needed |
| upstream | needs-triage | |
| xenial | DNE |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| bionic | DNE | |
| esm-infra-legacy/xenial | released | 7.0.33-0ubuntu0.16.04.16+esm5 |
| esm-infra/focal | DNE | |
| esm-infra/xenial | released | 7.0.33-0ubuntu0.16.04.16+esm5 |
| focal | DNE | |
| jammy | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | ignored | end of standard support |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| bionic | released | 7.2.24-0ubuntu0.18.04.15 |
| esm-infra/bionic | released | 7.2.24-0ubuntu0.18.04.15 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| bionic | DNE | |
| esm-infra/focal | released | 7.4.3-4ubuntu2.15 |
| focal | released | 7.4.3-4ubuntu2.15 |
| jammy | DNE | |
| trusty | DNE | |
| upstream | needs-triage | |
| xenial | DNE |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | released | 8.1.2-1ubuntu2.8 |
| kinetic | released | 8.1.7-1ubuntu3.1 |
| lunar | released | 8.1.12-1ubuntu2 |
| mantic | DNE | |
| noble | DNE | |
| oracular | DNE |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
EPSS
6.5 Medium
CVSS3
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability en ...
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
EPSS
6.5 Medium
CVSS3