medium CVSS 5.9

CVE-2024-2408·PHP vulnerability

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.

Severity
medium
Software
PHP
Fixed in
8.3.8
Published

Affected versions

From: 8.3.0

Until: 8.3.8

Fixed in: 8.3.8

How to fix this CVE

Update PHP to version 8.3.8 or later to patch the cryptographic weakness in the openssl_private_decrypt function. The vulnerability affects RSA decryption operations using PKCS1 padding when OpenSSL lacks implicit rejection protections. Ensure your system uses OpenSSL 3.2 or a patched stable distribution build that includes the rsa_pkcs1_implicit_rejection countermeasure.

sudo dnf update php

Defensia detects this vulnerability

How to check if you are affected

  1. Run `php -v` to display the installed PHP version; CVE-2024-2408 affects versions 8.3.0 through 8.3.7
  2. Check OpenSSL version with `openssl version` to confirm it is 3.2 or later, or verify your distribution applies the backported rsa_pkcs1_implicit_rejection patch
  3. Search application logs for calls to openssl_private_decrypt() by grepping source code: `grep -r 'openssl_private_decrypt' /path/to/app/` to identify which components perform RSA decryption
  4. After patching, re-run `php -v` to confirm PHP is updated to 8.3.8 or higher and verify OpenSSL library version with `php -i | grep 'OpenSSL'`

FAQ

What is CVE-2024-2408?

CVE-2024-2408 is a timing-based side-channel vulnerability in PHP's openssl_private_decrypt function when using default PKCS1 padding. Without proper OpenSSL patches, attackers may infer information about decrypted data through careful analysis of decryption response times.

Is CVE-2024-2408 being actively exploited?

No, CVE-2024-2408 is not listed as actively exploited by CISA, and no public proof-of-concept exploits are currently available. However, the Marvin Attack technique is well-documented in cryptographic research and warrants immediate patching.

What versions of PHP are affected by CVE-2024-2408?

PHP versions 8.3.0 through 8.3.7 are vulnerable on systems with unpatched OpenSSL. Fixed versions include PHP 8.1.29, 8.2.20, 8.3.8 and later on all platforms.

How do I check if my server is vulnerable to CVE-2024-2408?

Run `php -v` to check your PHP version (vulnerable if between 8.3.0–8.3.7), then run `openssl version` to verify OpenSSL is 3.2 or includes the rsa_pkcs1_implicit_rejection backport from your Linux distribution.

Does Defensia detect CVE-2024-2408?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PHP is installed on a monitored server, CVE-2024-2408 will appear in your dashboard with remediation steps.

Related PHP CVEs

CVE-2025-47916CVSS 10Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applications/core/modules/front/system/themeeditor.php), where a protected method named customCss can be invoked by unauthenticated users. This method passes the value of the content parameter to the Theme::makeProcessFunction() method; hence it is evaluated by the template engine. Accordingly, this can be exploited by unauthenticated attackers to inject and execute arbitrary PHP code by providing crafted template strings.
CVE-2026-28289CVSS 10FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207.
CVE-2024-5932CVSS 10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'give_title' parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely, and to delete arbitrary files.
CVE-2025-62521CVSS 10ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The vulnerability exists in `setup/routes/setup.php` where user input from the setup form is directly concatenated into a PHP configuration template without any validation or sanitization. Any parameter in the setup form can be used to inject PHP code that gets written to `Include/Config.php`, which is then executed on every page load. This is more severe than typical authenticated RCE vulnerabilities because it requires no credentials and affects the installation process that administrators must complete. Version 5.21.0 patches the issue.
CVE-2025-25174CVSS 10Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-2408. Free for 1 server.

Get started free