CVE catalog

CVE-2022-31629

UBUNTU-CVE-2022-31629

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published: Sep 28, 2022, 11:15:00 PM UTC
Updated: Aug 27, 2026, 11:04:45 PM UTC
Source: [NVD] · [CVE record]
EPSS: 49.57% · Oct 25, 2026

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	php7.4	11	`7.4.21-1+deb11u1`	vulnerable
Debian	php7.4	11	`7.4.25-1+deb11u1`	vulnerable
Debian	php7.4	11	`7.4.26-1`	vulnerable
Debian	php7.4	11	`7.4.28-1+deb11u1`	vulnerable
Debian	php7.4	11	`7.4.30-1+deb11u1`	vulnerable
Debian	php7.4	11	`7.4.33-1+deb11u1`	fixed
Ubuntu	php5	pro	`5.5.3+dfsg-1ubuntu2`	vulnerable
Ubuntu	php5	pro	`5.5.3+dfsg-1ubuntu3`	vulnerable
Ubuntu	php5	pro	`5.5.6+dfsg-1ubuntu1`	vulnerable
Ubuntu	php5	pro	`5.5.6+dfsg-1ubuntu2`	vulnerable
Ubuntu	php5	pro	`5.5.8+dfsg-2ubuntu1`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu1`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu2`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu3`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.1`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.2`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.3`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.4`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.5`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.6`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.7`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.9`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.11`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.12`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.13`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.14`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.16`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.17`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.19`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.20`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.21`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.22`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.23`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.24`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.25`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.26`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.27`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm1`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm2`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm3`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm4`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm5`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm6`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm8`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm10`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm11`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm12`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm13`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm14`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm15`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm16`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm17`	vulnerable
Ubuntu	php5	pro	`5.5.9+dfsg-1ubuntu4.29+esm18`	vulnerable
Ubuntu	php7.0	pro	`7.0.1-5`	vulnerable
Ubuntu	php7.0	pro	`7.0.1-6`	vulnerable
Ubuntu	php7.0	pro	`7.0.2-1`	vulnerable
Ubuntu	php7.0	pro	`7.0.2-3`	vulnerable
Ubuntu	php7.0	pro	`7.0.2-4`	vulnerable
Ubuntu	php7.0	pro	`7.0.2-5`	vulnerable
Ubuntu	php7.0	pro	`7.0.3-2`	vulnerable
Ubuntu	php7.0	pro	`7.0.3-3`	vulnerable
Ubuntu	php7.0	pro	`7.0.3-9ubuntu1`	vulnerable
Ubuntu	php7.0	pro	`7.0.4-5ubuntu1`	vulnerable
Ubuntu	php7.0	pro	`7.0.4-5ubuntu2`	vulnerable
Ubuntu	php7.0	pro	`7.0.4-7ubuntu1`	vulnerable
Ubuntu	php7.0	pro	`7.0.4-7ubuntu2`	vulnerable
Ubuntu	php7.0	pro	`7.0.4-7ubuntu2.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.8-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.8-0ubuntu0.16.04.2`	vulnerable
Ubuntu	php7.0	pro	`7.0.8-0ubuntu0.16.04.3`	vulnerable
Ubuntu	php7.0	pro	`7.0.13-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.15-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.15-0ubuntu0.16.04.2`	vulnerable
Ubuntu	php7.0	pro	`7.0.15-0ubuntu0.16.04.4`	vulnerable
Ubuntu	php7.0	pro	`7.0.18-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.22-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.28-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.30-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.32-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.1`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.2`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.3`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.4`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.5`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.6`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.7`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.9`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.11`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.12`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.14`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.15`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16+esm1`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16+esm2`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16+esm3`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16+esm4`	vulnerable
Ubuntu	php7.0	pro	`7.0.33-0ubuntu0.16.04.16+esm5`	fixed
Ubuntu	php7.2	18.04	`7.2.1-1ubuntu2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.2-1ubuntu1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.2-1ubuntu2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.3-1ubuntu1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.5-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.7-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.7-0ubuntu0.18.04.2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.10-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.15-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.15-0ubuntu0.18.04.2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.17-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.19-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.19-0ubuntu0.18.04.2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.1`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.2`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.3`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.4`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.6`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.7`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.8`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.9`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.10`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.11`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.12`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.13`	vulnerable
Ubuntu	php7.2	18.04	`7.2.24-0ubuntu0.18.04.15`	fixed
Ubuntu	php7.4	20.04	`7.4.3-4build1`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4build2`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu1`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu1.1`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.2`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.4`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.5`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.6`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.7`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.8`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.9`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.10`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.11`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.12`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.13`	vulnerable
Ubuntu	php7.4	20.04	`7.4.3-4ubuntu2.15`	fixed
Ubuntu	php8.1	22.04	`8.1.0~rc4-1ubuntu2`	vulnerable
Ubuntu	php8.1	22.04	`8.1.0-1`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu1`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.1`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.2`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.3`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.4`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.5`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.6`	vulnerable
Ubuntu	php8.1	22.04	`8.1.2-1ubuntu2.8`	fixed
Opensuse	php8	tumbleweed	`8.3.6-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	php7.4	deb	11	`7.4.33-1+deb11u1`	Not reported	DEBIAN-CVE-2022-31629	Not reported
Ubuntu	php7.0	deb	pro	`7.0.33-0ubuntu0.16.04.16+esm5`	Not reported	UBUNTU-CVE-2022-31629	Not reported
Ubuntu	php7.2	deb	18.04	`7.2.24-0ubuntu0.18.04.15`	Not reported	UBUNTU-CVE-2022-31629	Not reported
Ubuntu	php7.4	deb	20.04	`7.4.3-4ubuntu2.15`	Not reported	UBUNTU-CVE-2022-31629	Not reported
Ubuntu	php8.1	deb	22.04	`8.1.2-1ubuntu2.8`	Not reported	UBUNTU-CVE-2022-31629	Not reported
Opensuse	php8	rpm	tumbleweed	`8.3.6-1.1`	Not reported	OPENSUSE-SU-2024:13867-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[php8-bcmath]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-bz2]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-calendar]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-cli]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-ctype]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-curl]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-dba]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-devel]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-dom]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-enchant]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-exif]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-ffi]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-fileinfo]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-ftp]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-gd]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-gettext]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-gmp]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-iconv]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-intl]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed
[php8-ldap]Unknown
Source package: [php8]
Details (1)
- 8.5.9-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 8.3.6-1.1
  Version impact unknown
  pypi · php8 · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 6:27:16 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]