---
title: "CVE-2022-31626"
canonical: "https://kb.cynergy.app/space/MD/922681347/CVE-2022-31626"
format: markdown
---
**Description**

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.  


**Published On**

06/16/2022

**Updated On**

09/29/2022

**Trending**

FALSE

**CWE**

<u>[CWE-120](http://cwe.mitre.org/data/definitions/120.html)</u>

**Exploit**

[https://bugs.php.net/bug.php?id=81719](https://bugs.php.net/bug.php?id=81719) 


**Mitigation:**

![image](media://2bbc0bd6-9c9a-4035-b46e-8a89994b58df)

Cynergy has an automated mitigation capability that requires integration with your WAF provider.

Once integrated, you can request “Protect with WAF”

This will move the exposed asset behind WAF protection

<span style="color: #97a0af">**Note: **</span><span style="color: #97a0af">Policies configuration should be defined separately</span>

 

**Remediation**

Update to 8.0.20 - [http://www.php.net/releases/8_0_20.php](http://www.php.net/releases/8_0_20.php) 

 This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-0a96e5b9b1' at the command line. For more information, refer to the dnf documentation available at [http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label](http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label) 

**Reference**

[https://bugs.php.net/bug.php?id=81719](https://bugs.php.net/bug.php?id=81719)