In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Solution:
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
| Link | Tags |
|---|---|
| https://bugs.php.net/bug.php?id=81726 | third party advisory permissions required |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/ | vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/ | vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/ | vendor advisory |
| https://www.debian.org/security/2022/dsa-5277 | third party advisory vendor advisory |
| https://security.gentoo.org/glsa/202211-03 | third party advisory vendor advisory |
| https://security.netapp.com/advisory/ntap-20221209-0001/ | third party advisory |
| https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html | third party advisory mailing list |