Vulnerability · Published Jul 22, 2023 · Assigned by php

CVE-2023-3247Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

Low 2.6

In plain English

A low-severity weak randomness in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.6Low
Exploit odds (30 days)0.7%top 46.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. 

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8apcu-panel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:9apcu-panel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip-devel1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8libzip-devel1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8libzip-tools1.7.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8libzip-tools1.6.1-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-bcmath8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-bcmath7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-bcmath8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-bcmath8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-cli8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-cli7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-cli8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-cli8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-common8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-common7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-common8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-common8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-dba8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dba7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dba8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dba8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-dbg8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-dbg7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-dbg8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-dbg8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-devel7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-devel8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-devel8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-devel8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-embedded7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-embedded8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-embedded8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-embedded8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-enchant7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-enchant8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-enchant8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-enchant8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-ffi8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-ffi7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-ffi8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-ffi8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-fpm8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-fpm7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-fpm8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-fpm8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-gd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-gd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-gd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-gmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-gmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-gmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-gmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-intl8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-intl7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-intl8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-intl8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-json7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-ldap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-ldap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-ldap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-mbstring7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-mbstring8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-mbstring8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-mbstring8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-mysqlnd8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-mysqlnd7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-mysqlnd8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-mysqlnd8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-odbc8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-odbc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-odbc8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-odbc8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-opcache8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-opcache7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-opcache8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-opcache8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pdo7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pdo8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-pdo8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-pdo8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-pear1:1.10.13-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pear1:1.10.13-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-apcu5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-apcu-devel5.1.20-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:9php-pecl-apcu-devel5.1.21-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+3059+d65eee13ALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdefALSA-2024:10952
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-rrd2.0.3-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:9php-pecl-rrd2.0.3-4.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-xdebug33.1.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:9php-pecl-xdebug33.1.4-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcbALSA-2024:10952
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+2739+efabdb8fALSA-2023:5927
AlmaLinux:8php-pecl-zip1.19.2-1.module_el8.6.0+3061+6878dd1bALSA-2023:5927
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+3239+bedf0508ALSA-2024:10952
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-pecl-zip1.20.1-1.module_el9.1.0+15+94ba28e4ALSA-2024:0387
AlmaLinux:8php-pgsql7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-pgsql8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-pgsql8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-pgsql8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-process7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-process8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-process8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-process8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-snmp8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:8php-snmp7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:9php-snmp8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-snmp8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-soap7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-soap8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-soap8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:9php-soap8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:8php-xml7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
AlmaLinux:8php-xml8.0.30-1.module_el8.8.0+3655+3335cff6ALSA-2023:5927
AlmaLinux:9php-xml8.0.30-1.el9_2ALSA-2023:5926
AlmaLinux:9php-xml8.1.27-1.module_el9.3.0+53+44872dd1ALSA-2024:0387
AlmaLinux:8php-xmlrpc7.4.33-2.module_el8.10.0+3935+28808425ALSA-2024:10952
Debian:12php8.28.2.7-1~deb12u1DSA-5425-1
Debian:12php8.28.2.7-1~deb12u1DEBIAN-CVE-2023-3247
Rocky Linux:8libzip0:1.6.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8libzip0:1.7.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:8php0:8.0.30-1.module+el8.8.0+1550+d8f1b18fRLSA-2023:5927
Rocky Linux:8php0:7.4.33-2.module+el8.10.0+1912+72767185RLSA-2024:10952
Rocky Linux:9php0:8.0.30-1.el9_2RLSA-2023:5926
Rocky Linux:8php-pear1:1.10.13-1.module+el8.7.0+1067+0a7071ccRLSA-2023:5927
Rocky Linux:8php-pear1:1.10.13-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-apcu0:5.1.20-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-apcu0:5.1.21-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-rrd0:2.0.3-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32042+808943aeRLSA-2024:0387
Rocky Linux:9php-pecl-rrd0:2.0.3-4.module+el9.6.0+32041+66e66fb7RLSA-2024:0387
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-xdebug30:3.1.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-xdebug30:3.1.4-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.10.0+1604+6558efc7RLSA-2024:10952
Rocky Linux:8php-pecl-zip0:1.19.2-1.module+el8.6.0+790+fc63e43fRLSA-2023:5927
Rocky Linux:9php-pecl-zip0:1.20.1-1.module+el9.6.0+32040+1f1dedb8RLSA-2024:0387
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.13UBUNTU-CVE-2023-3247
Ubuntu:22.04:LTSphp8.18.1.2-1ubuntu2.13USN-6199-1

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.0.* – before 8.0.298.1.* – before 8.1.208.2.* – before 8.2.7

Weakness: CWE-252, CWE-330 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

References