Detections
Analytics

Echo: php-7.2: security update to 7.2.34+e1php-8.1: security update to 8.1.34+e1

medium Tenable Cloud Security Plugin ID 476618

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever
 no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the
 certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still
 accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can
 therefore be used to impersonate another. (CVE-2026-91769)

Solution

Update the php-7.2 library and its related packages to version 7.2.34+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-91769

Plugin Details

Severity: Medium

ID: 476618

Version: Revision 1.3

Type: Local

Published: 10/22/2026

Updated: 10/25/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-91769

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.9

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/22/2026

Vulnerability Publication Date: 9/22/2026

Reference Information

CVE: CVE-2026-91769