| Name | CVE-2023-3247 |
| Description | In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3458-1, DSA-5424-1, DSA-5425-1, ELA-873-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| php5 (PTS) | jessie, jessie (lts) | 5.6.40+dfsg-0+deb8u21 | vulnerable |
| php7.0 (PTS) | stretch (security) | 7.0.33-0+deb9u12 | vulnerable |
| stretch (lts), stretch | 7.0.33-0+deb9u19 | fixed | |
| php7.3 (PTS) | buster, buster (lts) | 7.3.31-1~deb10u8 | fixed |
| buster (security) | 7.3.31-1~deb10u7 | fixed | |
| php7.4 (PTS) | bullseye | 7.4.33-1+deb11u5 | fixed |
| bullseye (security) | 7.4.33-1+deb11u7 | fixed | |
| php8.2 (PTS) | bookworm | 8.2.24-1~deb12u1 | fixed |
| bookworm (security) | 8.2.26-1~deb12u1 | fixed | |
| sid, trixie | 8.2.26-4 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| php5 | source | (unstable) | (unfixed) | |||
| php7.0 | source | stretch | 7.0.33-0+deb9u15 | ELA-873-1 | ||
| php7.0 | source | (unstable) | (unfixed) | |||
| php7.3 | source | buster | 7.3.31-1~deb10u4 | DLA-3458-1 | ||
| php7.3 | source | (unstable) | (unfixed) | |||
| php7.4 | source | bullseye | 7.4.33-1+deb11u4 | DSA-5424-1 | ||
| php7.4 | source | (unstable) | (unfixed) | |||
| php8.2 | source | bookworm | 8.2.7-1~deb12u1 | DSA-5425-1 | ||
| php8.2 | source | (unstable) | 8.2.7-1 |
Fixed in 8.2.7, 8.1.20, 8.0.29
https://github.com/php/php-src/security/advisories/GHSA-76gg-c692-v2mw
https://github.com/php/php-src/commit/ac4254ad764c70cb1f05c9270d8d12689fc3aeb6 (php-8.0.29)
https://github.com/php/php-src/commit/32c7c433ac1983c4497349051681a4f361d3d33e (php-8.0.29)
[jessie] - php5 <ignored> (Only affected by the insufficient random bytes part of the CVE)
Pre-requisite: https://github.com/php/php-src/commit/b21de28bb70117d9bfe73efeb7d6bb5691b043e5
For php<7.1, only the 'insufficient random bytes' part of the CVE is affected.