CVE-2024-56522: 
PHP vulnerability analysis and mitigation

An issue was discovered in TCPDF before version 6.8.0, disclosed on December 27, 2024. The vulnerability affects the unserializeTCPDFtag function, which uses loose comparison (!=) and does not implement a constant-time function to compare TCPDF tag hashes. The vulnerability is tracked as CVE-2024-56522 and has been assigned a CVSS v3.1 base score of 7.5 (HIGH) (CISA-ADP).

The vulnerability exists in the unserializeTCPDFtag function where the code uses a loose comparison operator (!=) instead of a strict comparison, and lacks a constant-time comparison function for TCPDF tag hashes. This implementation could potentially lead to timing-based attacks. The issue has been assigned CWE-843 (Access of Resource Using Incompatible Type - 'Type Confusion') (CISA-ADP).

The vulnerability has been rated as HIGH with a CVSS v3.1 base score of 7.5, indicating potential high confidentiality impact but no impact on integrity or availability (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) (CISA-ADP).

The vulnerability has been fixed in TCPDF version 6.8.0 by implementing a strict time-constant function to compare TCPDF-tag hashes. Users are advised to upgrade to version 6.8.0 or later (TCPDF Commit).