{"id":"UBUNTU-CVE-2022-36937","details":"HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.","modified":"2026-04-22T15:38:32.159097Z","published":"2023-05-10T19:15:00Z","upstream":["CVE-2022-36937"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-36937"},{"type":"REPORT","url":"https://github.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b"},{"type":"REPORT","url":"https://hhvm.com/blog/2023/01/20/security-update.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2022-36937"}],"affected":[{"package":{"name":"hhvm","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/hhvm@3.11.1+dfsg-1ubuntu1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.11.0+dfsg-1","3.11.1+dfsg-1","3.11.1+dfsg-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"hhvm","binary_version":"3.11.1+dfsg-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-36937.json"}},{"package":{"name":"hhvm","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/hhvm@3.21.0+dfsg-2ubuntu2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.21.0+dfsg-2","3.21.0+dfsg-2build1","3.21.0+dfsg-2build2","3.21.0+dfsg-2build3","3.21.0+dfsg-2ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"hhvm","binary_version":"3.21.0+dfsg-2ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-36937.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}