description: HHVM 4.172.0 and all prior versions use TLS 1.0 for secure connections when handling tls:// URLs in the stream extension. TLS1.0 has numerous published vulnerabilities and is deprecated. HHVM 4.153.4, 4.168.2, 4.169.2, 4.170.2, 4.171.1, 4.172.1, 4.173.0 replaces TLS1.0 with TLS1.3.
Applications that call stream_socket_server or stream_socket_client functions with a URL starting with tls:// are affected.
problem types: CWE-1104: Use of Unmaintained Third Party Components
affected:
{
defaultStatus: unaffected
product: HHVM
vendor: Facebook
versions:
lessThan: 4.172.1, status: affected, version: 4.172.0, versionType: semver
lessThan: 4.171.1, status: affected, version: 4.171.0, versionType: semver
lessThan: 4.170.2, status: affected, version: 4.170.0, versionType: semver
lessThan: 4.169.2, status: affected, version: 4.169.0, versionType: semver
lessThan: 1.168.2, status: affected, version: 4.154.0, versionType: semver
lessThan: 4.153.4, status: affected, version: 0, versionType: semver
}