CVE-2022-31628: 
PHP vulnerability analysis and mitigation

CVE-2022-31628 is a vulnerability discovered in PHP versions before 7.4.31, 8.0.24, and 8.1.11, where the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop. The vulnerability was discovered in July 2022 and publicly disclosed in September 2022 (PHP Bug Report, CVE Mitre).

The vulnerability exists in the phar uncompressor code of PHP, where it fails to properly handle "quine" gzip files. When processing these specially crafted files, the code enters an infinite loop during decompression. The vulnerability has been assigned a CVSS score of 5.5 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NetApp Advisory).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition. The issue affects all PHP functions where the phar wrapper is available, including file operations such as file(), file_get_contents(), fopen(), and many others (PHP Bug Report).

The vulnerability has been fixed in PHP versions 7.4.31, 8.0.24, and 8.1.11. Users are recommended to upgrade to these or later versions. The fix implements a limit on the number of recursive decompressions to prevent infinite loops (Debian Security, Gentoo Security).