-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from using PHP's OpenSSL functions with insecure PKCS1v1.5 padding. The Zend\Crypt\PublicKey\Rsa component's encrypt/decrypt methods used openssl_public_encrypt/openssl_private_decrypt with default padding (OPENSSL_PKCS1_PADDING). The security advisory explicitly mentions these methods were patched by switching to OAEP padding. The file paths are inferred from standard Zend Framework structure and component naming conventions.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| zendframework/zendframework | composer | >= 2.5.0, < 2.5.2 | 2.5.2 |
| zendframework/zend-crypt | composer | >= 2.0.0, < 2.4.9 | 2.4.9 |
| zendframework/zend-crypt | composer | >= 2.5.0, < 2.5.2 | 2.5.2 |
| zendframework/zendframework | composer | >= 2.0.0, < 2.4.9 | 2.4.9 |
Ongoing coverage of React2Shell