Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
79576192 by Sylvain Beucler at 2026-07-13T15:43:08+02:00
CVE-2026-14355/php7.4: not-affected->ignored
For cases where the specific Debian configuration prevents exploitation, we
currently use 'ignored'.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4628,14 +4628,14 @@ CVE-2026-14355 (In PHP versions 8.2.* before 8.2.32,
8.3.* before 8.3.32, 8.4.*
- php8.4 8.4.23-1
- php8.2 <removed>
- php7.4 <removed>
- [bullseye] - php7.4 <not-affected> (AES wrap-pad path unreachable under
OpenSSL 1.1.1)
+ [bullseye] - php7.4 <ignored> (AES wrap-pad path unreachable under
OpenSSL 1.1.1)
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr
NOTE: https://github.com/php/php-src/issues/22186
NOTE:
https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5
(php-8.4.23RC1)
- NOTE: bullseye php7.4 links OpenSSL 1.1.1w, which rejects AES *-wrap
ciphers at
+ NOTE: php7.4/bullseye links OpenSSL 1.1.1w, which rejects AES *-wrap
ciphers at
NOTE: EVP_CipherInit (EVP_R_WRAP_MODE_NOT_ALLOWED) unless
EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
NOTE: is set; php never sets it, so the undersized buffer in
php_openssl_cipher_update()
- NOTE: is not reachable. Reachable only with OpenSSL 3.0 (bookworm
php8.2, fixed by DLA-4669-1).
+ NOTE: is not reachable. Reachable only with OpenSSL 3.x.
CVE-2026-12184 [PHP: Failure to setup TLS with a remote server can result in a
remote DoS]
{DSA-6256-1}
- php8.4 8.4.21-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/795761920f530f39df39c3ec03a65af66bd087d2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/795761920f530f39df39c3ec03a65af66bd087d2
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
