---
title: "CVE-2022-31625"
canonical: "https://kb.cynergy.app/space/MD/923631619/CVE-2022-31625"
format: markdown
---
**Description**
In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
**Published On**
06/16/2022
**Updated On**
10/07/2022
**Trending**
FALSE
**CWE**
[CWE-763](http://cwe.mitre.org/data/definitions/763.html)
[CWE-590](http://cwe.mitre.org/data/definitions/590.html)
[CWE-824](http://cwe.mitre.org/data/definitions/824.html)
**Exploit**
[https://bugs.php.net/bug.php?id=81720](https://bugs.php.net/bug.php?id=81720)
**Mitigation:**
Cynergy has an automated mitigation capability that requires integration with your WAF provider.
Once integrated, you can request “Protect with WAF”
This will move the exposed asset behind WAF protection
**Note: **Policies configuration should be defined separately
**Remediation**
- Update to 8.1.7 - [http://www.php.net/releases/8_1_7.php](http://www.php.net/releases/8_1_7.php)
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2022-f3fc52428e' at the command line. For more information, refer to the dnf documentation available at [http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label](http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label)
All PHP 7.4 users should upgrade to the latest version:
```
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.30:7.4"
```
All PHP 8.0 users should upgrade to the latest version:
```
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/php-8.0.23:8.0"
```
All PHP 8.1 users should upgrade to the latest version:
```
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/php-8.1.8:8.1"
```