The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade php-opcacheUpgrade php-intlUpgrade php-pdoUpgrade php-bcmathUpgrade php-pgsqlUpgrade php-ldapUpgrade php-dbgUpgrade phpUpgrade php-commonUpgrade php-embeddedUpgrade php-odbcUpgrade php-sodiumUpgrade php-fpmUpgrade php-gmpUpgrade php-cliUpgrade php-snmpUpgrade php-develUpgrade php-dbaUpgrade php-xmlUpgrade php-pspellUpgrade php-debuginfoUpgrade php-gdUpgrade php-processUpgrade php-soapUpgrade php-enchantUpgrade php-mysqlndUpgrade php-mbstring | Jun 26, 2024 | Jun 9, 2024 |
| Amazon_linux_2023 | — | Upgrade php8.2-opcacheUpgrade php8.2-zip-debuginfoUpgrade php8.1-zipUpgrade php8.2-dbg-debuginfoUpgrade php8.1-xml-debuginfoUpgrade php8.2-pspellUpgrade php8.2-develUpgrade php8.2-cli-debuginfoUpgrade php8.1-ffi-debuginfoUpgrade php8.2-snmpUpgrade php8.1Upgrade php8.2-enchant-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.1-dbaUpgrade php8.1-commonUpgrade php8.2-mbstringUpgrade php8.1-mysqlnd-debuginfoUpgrade php8.2-cliUpgrade php8.2-processUpgrade php8.2-process-debuginfoUpgrade php8.2-dbaUpgrade php8.2-debuginfoUpgrade php8.1-debuginfoUpgrade php8.1-odbcUpgrade php8.2-fpm-debuginfoUpgrade php8.2-pgsqlUpgrade php8.2-soapUpgrade php8.1-embeddedUpgrade php8.2-mysqlndUpgrade php8.2-pgsql-debuginfoUpgrade php8.1-gmpUpgrade php8.2-xml-debuginfoUpgrade php8.2-opcache-debuginfoUpgrade php8.1-embedded-debuginfoUpgrade php8.1-ldap-debuginfoUpgrade php8.2-gmp-debuginfoUpgrade php8.2-intl-debuginfoUpgrade php8.2-ffiUpgrade php8.1-tidyUpgrade php8.1-pdoUpgrade php8.1-ffiUpgrade php8.1-gd-debuginfoUpgrade php8.2-dbgUpgrade php8.1-dba-debuginfoUpgrade php8.1-dbgUpgrade php8.1-intlUpgrade php8.1-fpm-debuginfoUpgrade php8.1-snmpUpgrade php8.2Upgrade php8.2-gdUpgrade php8.2-ldapUpgrade php8.2-soap-debuginfoUpgrade php8.1-pdo-debuginfoUpgrade php8.1-common-debuginfoUpgrade php8.1-enchantUpgrade php8.2-bcmath-debuginfoUpgrade php8.2-odbc-debuginfoUpgrade php8.1-debugsourceUpgrade php8.1-gmp-debuginfoUpgrade php8.1-xmlUpgrade php8.1-processUpgrade php8.1-soap-debuginfoUpgrade php8.1-process-debuginfoUpgrade php8.1-pgsqlUpgrade php8.2-embeddedUpgrade php8.1-mysqlndUpgrade php8.1-intl-debuginfoUpgrade php8.1-gdUpgrade php8.1-bcmathUpgrade php8.1-dbg-debuginfoUpgrade php8.2-enchantUpgrade php8.2-debugsourceUpgrade php8.2-bcmathUpgrade php8.1-snmp-debuginfoUpgrade php8.2-fpmUpgrade php8.2-sodiumUpgrade php8.1-soapUpgrade php8.1-pspell-debuginfoUpgrade php8.1-mbstring-debuginfoUpgrade php8.2-tidyUpgrade php8.1-fpmUpgrade php8.1-cli-debuginfoUpgrade php8.1-bcmath-debuginfoUpgrade php8.1-pspellUpgrade php8.2-xmlUpgrade php8.1-mbstringUpgrade php8.2-common-debuginfoUpgrade php8.2-pdoUpgrade php8.2-gd-debuginfoUpgrade php8.2-gmpUpgrade php8.2-zipUpgrade php8.1-enchant-debuginfoUpgrade php8.1-develUpgrade php8.2-snmp-debuginfoUpgrade php8.2-commonUpgrade php8.2-dba-debuginfoUpgrade php8.1-ldapUpgrade php8.1-cliUpgrade php8.2-ffi-debuginfoUpgrade php8.2-pdo-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.2-ldap-debuginfoUpgrade php8.2-intlUpgrade php8.1-pgsql-debuginfoUpgrade php8.1-zip-debuginfoUpgrade php8.1-odbc-debuginfoUpgrade php8.1-opcacheUpgrade php8.2-pspell-debuginfoUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-sodium-debuginfoUpgrade php8.2-odbcUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.1-tidy-debuginfoUpgrade php8.1-opcache-debuginfo | Feb 17, 2025 | Jun 7, 2024 |
| Debian | — | Upgrade php8.2 | Sep 30, 2024 | Jun 9, 2024 |
| Php | — | Upgrade to PHP version 8.3.8Upgrade to PHP version 8.1.29Upgrade to PHP version 8.2.20 | Jun 14, 2024 | Jun 9, 2024 |
| Redhat_linux | — | Upgrade openssl-debugsourceUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-develUpgrade openssl-libs-debuginfoUpgrade openssl-libsUpgrade openssl-perlNo solution exists | Jul 9, 2025 | Jun 9, 2024 |
| Rocky_linux | — | Upgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-perlUpgrade opensslUpgrade openssl-libs-debuginfo | Dec 4, 2025 | Dec 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub