PHP 7

Tenable plugin 165545 flags PHP 7.4.x < 7.4.32 for two issues: CVE-2022-31629, where PHP can mangle crafted cookie names so an insecure cookie is treated like __Host- or __Secure-; and CVE-2022-31628, where PHAR/gzip handling can spin into an infinite loop on a malicious quine archive. Tenable keys off the installed PHP version, while the upstream CVE records describe the affected lines as PHP before 7.4.31 / 8.0.24 / 8.1.11; the practical upstream security release for 7.4 users was 7.4.32, which is what the plugin expects.

This should not be treated like a generic internet-facing PHP RCE. The vendor-style score is inflated if you read only the integrity impact on paper: CVE-2022-31629 needs a same-site sibling-domain foothold or on-path network position *and* an app that actually trusts __Host-/__Secure- cookie semantics for security decisions; CVE-2022-31628 is mostly an app-assisted DoS path around attacker-controlled PHAR/gzip input. For a fleet view, that lands in MEDIUM: worth fixing, but not a drop-everything event.

Why this verdict

• Start from the real baseline: the strongest CVE in the bundle is CVE-2022-31629 at 6.5/MEDIUM, not a critical PHP runtime bug.
• Downshift for attacker position: exploitation usually requires a same-site sibling domain or on-path network control, which implies prior foothold, domain hygiene failure, or internal-network advantage rather than raw internet reach.
• Downshift for app dependence: impact only materializes when the target PHP application uses __Host-/__Secure- cookies in integrity-sensitive logic such as CSRF or trust binding; many deployments do not.
• Keep it at MEDIUM, not LOW: PHP is ubiquitous, the bug is silent when it works, and CVE-2022-31629 has a nontrivial EPSS signal, so this is more than backlog lint.
• Ignore the sidecar inflation: CVE-2022-31628 is mostly an app-assisted DoS route around attacker-controlled PHAR/gzip handling and should not pull the bundle upward.

Why not higher?

There is no pre-auth RCE, no broad data-exfil path, no KEV evidence, and no one-packet internet exploit. The highest-impact path depends on browser interaction plus specific app trust decisions, so the blast radius is much narrower than the product footprint suggests.

Why not lower?

This is still a security-control bypass in a very common runtime, not just a cosmetic parser quirk. If you have shadow subdomains, mixed HTTP/HTTPS inside the same parent domain, or legacy CSRF patterns tied to prefixed cookies, the bug can be operationally relevant.

1. Audit sibling-domain trust — Inventory dangling, parked, and legacy subdomains under the same parent domain, then remove or lock them down. This cuts off the most realistic CVE-2022-31629 attacker position; for a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but do this sooner on internet-facing estates because it reduces more than one class of web risk.
2. Enforce HTTPS and HSTS consistently — Remove plain-HTTP footholds that let on-path or downgrade-style cookie planting happen on sibling properties. This is a structural defense, not a full fix, and for MEDIUM there is no mitigation SLA — go straight to the 365-day remediation window.
3. Review cookie-trust patterns in PHP apps — Identify applications that treat __Host- or __Secure- cookies as integrity anchors for CSRF, request validation, or session security. Where found, revalidate those assumptions and pair with server-side checks while you remediate within the 365-day window.
4. Constrain PHAR handling of untrusted input — For upload-heavy apps, review any use of phar://, PharData, or archive inspection against user-controlled files. This specifically narrows the DoS sidecar CVE-2022-31628; again, MEDIUM means no mitigation SLA — go straight to the 365-day remediation window.

Run this on the target Linux host that actually serves PHP, not on the scanner. Save it as check_php_165545.sh and run sudo bash check_php_165545.sh; root is helpful for package metadata access but usually not strictly required. The script checks upstream PHP 7.4.32 and common Debian/Ubuntu backports, then prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_php_165545.sh
# Verify exposure for Nessus plugin 165545 / PHP 7.4.x < 7.4.32
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

FIXED_UPSTREAM="7.4.32"
FIXED_UBUNTU_FOCAL="7.4.3-4ubuntu2.15"
FIXED_DEBIAN_BULLSEYE="7.4.33-1+deb11u1"

print_result() {
  local status="$1"
  local msg="$2"
  echo "$status: $msg"
  case "$status" in
    PATCHED) exit 0 ;;
    VULNERABLE) exit 1 ;;
    *) exit 2 ;;
  esac
}

ver_ge() {
  # semantic-ish compare for upstream versions
  [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

php_ver=""
if command -v php >/dev/null 2>&1; then
  php_ver="$(php -r 'echo PHP_VERSION;' 2>/dev/null || true)"
fi

os_id=""
os_ver=""
if [ -r /etc/os-release ]; then
  . /etc/os-release
  os_id="${ID:-}"
  os_ver="${VERSION_ID:-}"
fi

# Debian/Ubuntu package-aware checks first because distro backports matter.
if command -v dpkg-query >/dev/null 2>&1; then
  pkg_ver=""
  for p in php7.4-cli php7.4-fpm libapache2-mod-php7.4 php7.4-common php7.4; do
    if dpkg-query -W -f='${Version}\n' "$p" >/dev/null 2>&1; then
      pkg_ver="$(dpkg-query -W -f='${Version}\n' "$p" 2>/dev/null | head -n1)"
      [ -n "$pkg_ver" ] && break
    fi
  done

  if [ -n "$pkg_ver" ]; then
    if [ "$os_id" = "ubuntu" ] && [ "$os_ver" = "20.04" ]; then
      if dpkg --compare-versions "$pkg_ver" ge "$FIXED_UBUNTU_FOCAL"; then
        print_result PATCHED "Ubuntu 20.04 package version $pkg_ver includes the fix line for CVE-2022-31628/CVE-2022-31629."
      else
        print_result VULNERABLE "Ubuntu 20.04 package version $pkg_ver is older than fixed backport $FIXED_UBUNTU_FOCAL."
      fi
    fi

    if [ "$os_id" = "debian" ] && [ "$os_ver" = "11" ]; then
      if dpkg --compare-versions "$pkg_ver" ge "$FIXED_DEBIAN_BULLSEYE"; then
        print_result PATCHED "Debian 11 package version $pkg_ver includes the DSA-5277 fix line."
      else
        print_result VULNERABLE "Debian 11 package version $pkg_ver is older than fixed backport $FIXED_DEBIAN_BULLSEYE."
      fi
    fi

    # Fallback for other dpkg-based systems: use the runtime version if available.
    if [ -n "$php_ver" ]; then
      case "$php_ver" in
        7.4.*)
          if ver_ge "$php_ver" "$FIXED_UPSTREAM"; then
            print_result PATCHED "Runtime reports PHP $php_ver (>= $FIXED_UPSTREAM)."
          else
            print_result VULNERABLE "Runtime reports PHP $php_ver (< $FIXED_UPSTREAM) and no recognized backport rule matched."
          fi
          ;;
        8.*|9.*)
          print_result PATCHED "Runtime reports PHP $php_ver; plugin 165545 targets 7.4.x only."
          ;;
      esac
    fi
  fi
fi

# RPM-based best-effort: changelog hit is stronger than raw version because of backports.
if command -v rpm >/dev/null 2>&1; then
  for p in php php-cli php-fpm php-common; do
    if rpm -q "$p" >/dev/null 2>&1; then
      if rpm -q --changelog "$p" 2>/dev/null | grep -Eq 'CVE-2022-31628|CVE-2022-31629|RHSA-2023:2903|ALSA-2023:2903|ELSA-2023:0848'; then
        print_result PATCHED "RPM package $p changelog shows a backport/fix reference for CVE-2022-31628/CVE-2022-31629."
      fi
    fi
  done
fi

# Pure upstream/source-build check.
if [ -n "$php_ver" ]; then
  case "$php_ver" in
    7.4.*)
      if ver_ge "$php_ver" "$FIXED_UPSTREAM"; then
        print_result PATCHED "Runtime reports upstream PHP $php_ver (>= $FIXED_UPSTREAM)."
      else
        print_result VULNERABLE "Runtime reports upstream PHP $php_ver (< $FIXED_UPSTREAM)."
      fi
      ;;
    8.*|9.*)
      print_result PATCHED "Runtime reports PHP $php_ver; this specific finding is for PHP 7.4.x."
      ;;
    *)
      print_result UNKNOWN "PHP runtime found ($php_ver), but this script only classifies PHP 7.4.x precisely for plugin 165545."
      ;;
  esac
fi

print_result UNKNOWN "Could not determine a PHP 7.4 runtime or package state with enough confidence. Check package manager metadata and distro advisories manually."

Sources

1. Tenable Nessus Plugin 165545
2. PHP 7.4.32 Release Announcement
3. PHP Bug #81727 / CVE-2022-31629
4. PHP Bug #81726 / CVE-2022-31628
5. NVD CVE-2022-31629
6. CIRCL Vulnerability Lookup CVE-2022-31629
7. GitHub Advisory CVE-2022-31628
8. Ubuntu USN-5717-1 PHP vulnerabilities