CVE-2022-40482

Name	CVE-2022-40482
Description	The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php-laravel-framework (PTS)	bookworm	8.83.26+dfsg-2	fixed
	trixie	10.48.29+dfsg-1	fixed
	forky	13.31.0+dfsg-1	fixed
	sid	13.31.0+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php-laravel-framework	source	(unstable)	8.83.26+dfsg-1

Notes

https://github.com/laravel/framework/pull/44069
Fixed by: https://github.com/laravel/framework/commit/3145c6010fbba00ec80ef5cda87fe74885de2ade (v8.83.24)