[Git][security-tracker-team/security-tracker][master] lts: php7.4 not-affected in bullseye (CVE-2026-14355)

[Utkarsh Gupta (@utkarsh)]

Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6dff372a by Utkarsh Gupta at 2026-07-11T02:38:22+05:30
lts: php7.4 not-affected in bullseye (CVE-2026-14355)

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3862,9 +3862,14 @@ CVE-2026-14355 (In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.*
 	- php8.4 8.4.23-1
 	- php8.2 <removed>
 	- php7.4 <removed>
+	[bullseye] - php7.4 <not-affected> (AES wrap-pad path unreachable under OpenSSL 1.1.1)
 	NOTE: https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr
 	NOTE: https://github.com/php/php-src/issues/22186
 	NOTE: https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5 (php-8.4.23RC1)
+	NOTE: bullseye php7.4 links OpenSSL 1.1.1w, which rejects AES *-wrap ciphers at
+	NOTE: EVP_CipherInit (EVP_R_WRAP_MODE_NOT_ALLOWED) unless EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
+	NOTE: is set; php never sets it, so the undersized buffer in php_openssl_cipher_update()
+	NOTE: is not reachable. Reachable only with OpenSSL 3.0 (bookworm php8.2, fixed by DLA-4669-1).
 CVE-2026-12184 [PHP: Failure to setup TLS with a remote server can result in a remote DoS]
 	{DSA-6256-1}
 	- php8.4 8.4.21-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6dff372a3eb2fbdfaeed99554b107ed5c65c9e2c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6dff372a3eb2fbdfaeed99554b107ed5c65c9e2c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260710/bf7191e5/attachment.htm>