CVE-2017-11144
Status: ModifiedHigh (7.5)—
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 6.16%
- Percentile among all scored CVEs: 93
- Score date: 10/17/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-754
References
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3
- http://openwall.com/lists/oss-security/2017/07/10/6
- http://php.net/ChangeLog-5.php
- http://php.net/ChangeLog-7.php
- https://access.redhat.com/errata/RHSA-2018:1296
- https://bugs.php.net/bug.php?id=74651
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.debian.org/security/2018/dsa-4080
- https://www.debian.org/security/2018/dsa-4081
- https://www.tenable.com/security/tns-2017-12
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6
- http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3
- http://openwall.com/lists/oss-security/2017/07/10/6
- http://php.net/ChangeLog-5.php
- http://php.net/ChangeLog-7.php
- https://access.redhat.com/errata/RHSA-2018:1296
- https://bugs.php.net/bug.php?id=74651
- https://security.netapp.com/advisory/ntap-20180112-0001/
- https://www.debian.org/security/2018/dsa-4080
- https://www.debian.org/security/2018/dsa-4081
- https://www.tenable.com/security/tns-2017-12
Raw JSON (NVD)
Show
{
"id": "CVE-2017-11144",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-07-10T14:29:00.620",
"references": [
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e",
"source": "cve@mitre.org"
},
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6",
"source": "cve@mitre.org"
},
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3",
"source": "cve@mitre.org"
},
{
"url": "http://openwall.com/lists/oss-security/2017/07/10/6",
"tags": [
"Mailing List"
],
"source": "cve@mitre.org"
},
{
"url": "http://php.net/ChangeLog-5.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://php.net/ChangeLog-7.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:1296",
"source": "cve@mitre.org"
},
{
"url": "https://bugs.php.net/bug.php?id=74651",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2018/dsa-4080",
"source": "cve@mitre.org"
},
{
"url": "https://www.debian.org/security/2018/dsa-4081",
"source": "cve@mitre.org"
},
{
"url": "https://www.tenable.com/security/tns-2017-12",
"source": "cve@mitre.org"
},
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2017/07/10/6",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://php.net/ChangeLog-5.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://php.net/ChangeLog-7.php",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:1296",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugs.php.net/bug.php?id=74651",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2018/dsa-4080",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2018/dsa-4081",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.tenable.com/security/tns-2017-12",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-754"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission."
},
{
"lang": "es",
"value": "En PHP, en versiones anteriores a la 5.6.31, las versiones 7.x anteriores a la 7.0.21 y las versiones 7.1.x anteriores a la 7.1.7, el código de sellado PEM de la extensión openssl no comprobó el valor de retorno de la función de sellado de OpenSSL, lo que podría conducir al cierre inesperado del intérprete de PHP. Esto está relacionado con un conflicto de interpretación para un número negativo en ext/openssl/openssl.c y una omisión de documentación OpenSSL."
}
],
"lastModified": "2026-06-17T01:01:17.970",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "399EA21A-9B46-4F4F-9A33-4DC557B11743",
"versionEndIncluding": "5.6.30"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB6890AF-8A0A-46EE-AAD5-CF9AAE14A321"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B90B947-7B54-47F3-9637-2F4AC44079EE"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "35848414-BD5D-4164-84DC-61ABBB1C4152"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B1F8402-8551-4F66-A9A7-81D472AB058E"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A773E8E-48CD-4D35-A0FD-629BD9334486"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC492340-79AF-4676-A161-079A97EC6F0C"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F1C2D8FE-C380-4B43-B634-A3DBA4700A71"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EB58393-0C10-413C-8D95-6BAA8BC19A1B"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "751F51CA-9D88-4971-A6EC-8C0B72E8E22B"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37B74118-8FC2-44CB-9673-A83DF777B2E6"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D56A200-1477-40DA-9444-CFC946157C69"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD0D1CCC-A857-4C15-899E-08F9255CEE34"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6745CC43-2836-4CD8-848F-EEA08AE9D5AC"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7BEB6696-14F9-4D9B-9974-B682FFBB828E"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04146390-021D-4147-9830-9EAA90D120A7"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B124547-DC1D-4A92-B8AB-8A1900063786"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F45B2127-CF3D-4D59-9042-AE6DF2908319"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "29A450E3-931F-4487-A76D-80A38210297A"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C099A0C4-883D-42ED-8359-FFD3ADD692A3"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.19:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ABD07432-5A23-491E-892E-42F0F58307D0"
},
{
"criteria": "cpe:2.3:a:php:php:7.0.20:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19627ECC-9342-4917-8FCC-7757339E3242"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0C68AA43-ED90-4B98-A5F8-4E210C2CC7CD"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2466D297-9442-40B0-A1A7-F9D166396CF8"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EADBF7EE-18DC-49F9-BF2F-A09BBAE76F45"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1726E9B6-A7FA-402B-A911-0CE81C623087"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3670FF7-2CA3-41A4-92FE-0123497E4E87"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C22CE03-DFE5-4CD3-B229-10B219A55434"
},
{
"criteria": "cpe:2.3:a:php:php:7.1.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C258AF27-84DF-4FC3-A651-1349BB567FB9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}