by Kastro
Paper/Archive/CVE-2022-36937

CVE-2022-36937

Facebook HHVM — HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.6.446 × 208.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.

Affected

ProductAffectedFixed inSource
HHVM4.172.0 – < 4.172.14.172.1CNA
HHVM4.171.0 – < 4.171.14.171.1CNA
HHVM4.170.0 – < 4.170.24.170.2CNA
HHVM4.169.0 – < 4.169.24.169.2CNA
HHVM4.154.0 – < 1.168.21.168.2CNA
HHVM< 4.153.44.153.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhhvm.com/blog/2023/01/20/security-update.htmlrefgithub.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b