TI-2022-17147 Aliases CVE-2022-36937 GHSA-f3qf-gc58-29p6

Broken or risky cryptographic algorithm in Meta HHVM

MEDIUM 49CWE-327Published 2023-05-10 · Updated 2025-01-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-327.

Summary

HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3. Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00527 44th percentileScored 2026-11-07

Fix Fixed HHVM (Facebook): 4.172.1, 4.171.1, 4.170.2 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	HHVM	4.172.0 to before 4.172.1; 4.171.0 to before 4.171.1; 4.170.0 to before 4.170.2; 4.169.0 to before 4.169.2; 4.154.0 to before 1.168.2; before 4.153.4	4.172.1, 4.171.1, 4.170.2, 4.169.2, 1.168.2, 4.153.4	Patch available	CNA

HHVM VendorMeta Affected 4.172.0 to before 4.172.1; 4.171.0 to before 4.171.1; 4.170.0 to before 4.170.2; 4.169.0 to before 4.169.2; 4.154.0 to before 1.168.2; before 4.153.4 Fixed in 4.172.1, 4.171.1, 4.170.2, 4.169.2, 1.168.2, 4.153.4 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:facebook:hhvm::::::::	before 4.153.4; 4.154.0 to before 4.168.2; 4.169.0 to before 4.169.2; 4.170.0 to before 4.170.2	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.171.0:::::::*	4.171.0	Vulnerable	Meta
cpe:2.3:a:facebook:hhvm:4.172.0:::::::*	4.172.0	Vulnerable	Meta

cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* Versions before 4.153.4; 4.154.0 to before 4.168.2; 4.169.0 to before 4.169.2; 4.170.0 to before 4.170.2 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.171.0:*:*:*:*:*:*:* Versions 4.171.0 Vulnerable ·Meta
cpe:2.3:a:facebook:hhvm:4.172.0:*:*:*:*:*:*:* Versions 4.172.0 Vulnerable ·Meta

Remediation

Fix · CNA HHVM (Facebook) Fixed in 4.172.1, 4.171.1, 4.170.2, 4.169.2, 1.168.2, 4.153.4

Timeline

2026-10-02 Threatist record created from CVE-2022-36937
2026-10-03 Alias added: GHSA-f3qf-gc58-29p6

References

Patch 1

https://github.com/facebook/hhvm/commit/083f5ffdee661f61512909d16f9a5b98cff3cf0b

Advisory 1

https://hhvm.com/blog/2023/01/20/security-update.html

TI-2018-04659 Improper input validation in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2019-08934 Memory corruption in Meta HHVM CVSS 3.1CRITICAL 9.8
TI-2021-06352 Heap-based buffer overflow in Meta folly CVSS 3.1CRITICAL 9.8
TI-2019-08935 An invalid free in mb_detect_order can cause the application to crash or potentially… CVSS 3.1CRITICAL 9.8
TI-2016-05898 Integer overflow in bcmath in Facebook HHVM before 3.15.0 allows attackers to have… CVSS 3.0CRITICAL 9.8
TI-2019-08931 Memory corruption in Meta HHVM CVSS 3.0CRITICAL 9.8

See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences