Utkarsh Gupta pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6dff372a by Utkarsh Gupta at 2026-07-11T02:38:22+05:30
lts: php7.4 not-affected in bullseye (CVE-2026-14355)
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3862,9 +3862,14 @@ CVE-2026-14355 (In PHP versions 8.2.* before 8.2.32,
8.3.* before 8.3.32, 8.4.*
- php8.4 8.4.23-1
- php8.2 <removed>
- php7.4 <removed>
+ [bullseye] - php7.4 <not-affected> (AES wrap-pad path unreachable under
OpenSSL 1.1.1)
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr
NOTE: https://github.com/php/php-src/issues/22186
NOTE:
https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5
(php-8.4.23RC1)
+ NOTE: bullseye php7.4 links OpenSSL 1.1.1w, which rejects AES *-wrap
ciphers at
+ NOTE: EVP_CipherInit (EVP_R_WRAP_MODE_NOT_ALLOWED) unless
EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
+ NOTE: is set; php never sets it, so the undersized buffer in
php_openssl_cipher_update()
+ NOTE: is not reachable. Reachable only with OpenSSL 3.0 (bookworm
php8.2, fixed by DLA-4669-1).
CVE-2026-12184 [PHP: Failure to setup TLS with a remote server can result in a
remote DoS]
{DSA-6256-1}
- php8.4 8.4.21-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6dff372a3eb2fbdfaeed99554b107ed5c65c9e2c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6dff372a3eb2fbdfaeed99554b107ed5c65c9e2c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
