CVE-2022-31629

Name	CVE-2022-31629
Description	In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3243-1, DSA-5277-1
Debian Bugs	1021138

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php7.4 (PTS)	bullseye	7.4.33-1+deb11u5	fixed
	bullseye (security)	7.4.33-1+deb11u9	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
php7.3	source	buster	7.3.31-1~deb10u2	DLA-3243-1
php7.3	source	(unstable)	(unfixed)
php7.4	source	bullseye	7.4.33-1+deb11u1	DSA-5277-1
php7.4	source	(unstable)	(unfixed)
php8.1	source	(unstable)	8.1.12-1		1021138

Fixed in 8.1.11, 7.4.32
PHP Bug: https://bugs.php.net/bug.php?id=81727
https://github.com/php/php-src/commit/0611be4e82887cee0de6c4cbae320d34eec946ca