CVE-2022-36937

Published: May 10, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.

Affected (6)

Products: Facebook: Hhvm

Facebook

1 product

Hhvm

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Facebook Hhvm	Before 4.153.4
Facebook Hhvm	From 4.154.0 to 4.168.2
Facebook Hhvm	From 4.169.0 to 4.169.2
Facebook Hhvm	From 4.170.0 to 4.170.2
Facebook Hhvm	Version 4.171.0
Facebook Hhvm	Version 4.172.0