{"id":"CVE-2022-4900","state":"PUBLISHED","title":"Potential buffer overflow in php_cli_server_startup_workers","description":"A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.","publishedAt":"2023-11-02T15:01:28.590Z","updatedAt":"2025-11-03T21:46:48.606Z","severity":{"score":6.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a php","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Software Collections","Fedora Fedora"],"affected":[{"vendor":"n/a","product":"php","versions":[{"version":"8.0.22","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"php","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"php","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:7.4/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:8.0/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php:8.1/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Software Collections","packageName":"rh-php73-php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_software_collections:3"]},{"vendor":"Fedora","product":"Fedora","packageName":"php","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2022-4900","https://bugzilla.redhat.com/show_bug.cgi?id=2179880","https://security.netapp.com/advisory/ntap-20231130-0008/","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"],"weaknesses":["CWE-119"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4900.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-4900","state":"PUBLISHED","datePublished":"2023-11-02T15:01:28.590Z","dateUpdated":"2025-11-03T21:46:48.606Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-01-31T10:50:33.011Z"},"containers":{"cna":{"title":"Potential buffer overflow in php_cli_server_startup_workers","descriptions":[{"lang":"en","value":"A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow."}],"affected":[{"vendor":"n/a","product":"php","versions":[{"version":"8.0.22","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"php","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"php","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:7.4/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"php:8.0/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"php:8.1/php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Software Collections","packageName":"rh-php73-php","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_software_collections:3"]},{"vendor":"Fedora","product":"Fedora","packageName":"php","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2022-4900","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179880","name":"RHBZ#2179880","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0008/"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-119","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2023-11-30T22:06:21.070Z"},"datePublic":"2022-07-13T00:00:00.000Z","x_redhatCweChain":"CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","timeline":[{"lang":"en","time":"2023-01-31T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2022-07-13T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2022-4900","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179880","name":"RHBZ#2179880","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0008/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T21:46:48.606Z"}}]}}}