[Git][security-tracker-team/security-tracker][master] CVE-2026-14355/php7.4: not-affected->ignored

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
79576192 by Sylvain Beucler at 2026-07-13T15:43:08+02:00
CVE-2026-14355/php7.4: not-affected->ignored

For cases where the specific Debian configuration prevents exploitation, we currently use 'ignored'.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4628,14 +4628,14 @@ CVE-2026-14355 (In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.*
 	- php8.4 8.4.23-1
 	- php8.2 <removed>
 	- php7.4 <removed>
-	[bullseye] - php7.4 <not-affected> (AES wrap-pad path unreachable under OpenSSL 1.1.1)
+	[bullseye] - php7.4 <ignored> (AES wrap-pad path unreachable under OpenSSL 1.1.1)
 	NOTE: https://github.com/php/php-src/security/advisories/GHSA-7jrw-539f-x6vr
 	NOTE: https://github.com/php/php-src/issues/22186
 	NOTE: https://github.com/php/php-src/commit/169226847426368c62992af43c2c39b0fdbff4d5 (php-8.4.23RC1)
-	NOTE: bullseye php7.4 links OpenSSL 1.1.1w, which rejects AES *-wrap ciphers at
+	NOTE: php7.4/bullseye links OpenSSL 1.1.1w, which rejects AES *-wrap ciphers at
 	NOTE: EVP_CipherInit (EVP_R_WRAP_MODE_NOT_ALLOWED) unless EVP_CIPHER_CTX_FLAG_WRAP_ALLOW
 	NOTE: is set; php never sets it, so the undersized buffer in php_openssl_cipher_update()
-	NOTE: is not reachable. Reachable only with OpenSSL 3.0 (bookworm php8.2, fixed by DLA-4669-1).
+	NOTE: is not reachable. Reachable only with OpenSSL 3.x.
 CVE-2026-12184 [PHP: Failure to setup TLS with a remote server can result in a remote DoS]
 	{DSA-6256-1}
 	- php8.4 8.4.21-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/795761920f530f39df39c3ec03a65af66bd087d2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/795761920f530f39df39c3ec03a65af66bd087d2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260713/e5061b4a/attachment-0001.htm>