Lucene search

[email protected]CVE-2020-7069

HistoryOct 02, 2020 - 3:15 p.m.

CVE-2020-7069

2020-10-0215:15:12

CWE-326

CWE-20

[email protected]

web.nvd.nist.gov

1423

php

openssl

security

encryption

cve-2020-7069

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.8%

JSON

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Affected configurations

NVD

Node

phpphpRange7.2.0–7.2.34

phpphpRange7.3.0–7.3.23

phpphpRange7.4.0–7.4.11

Node

fedoraprojectfedoraMatch31

fedoraprojectfedoraMatch32

fedoraprojectfedoraMatch33

Node

debiandebian_linuxMatch10.0

Node

opensuseleapMatch15.1

opensuseleapMatch15.2

Node

canonicalubuntu_linuxMatch12.04-

canonicalubuntu_linuxMatch14.04esm

canonicalubuntu_linuxMatch16.04lts

canonicalubuntu_linuxMatch18.04lts

canonicalubuntu_linuxMatch20.04lts

Node

netappclustered_data_ontapMatch-

Node

oraclecommunications_diameter_signaling_routerRange8.0.0–8.5.0

Node

tenabletenable.scRange<5.19.0

CPENameOperatorVersion
php:phpphplt7.2.34
php:phpphplt7.3.23
php:phpphplt7.4.11

CPE	Name	Operator	Version
php:php	php	lt	7.2.34
php:php	php	lt	7.3.23
php:php	php	lt	7.4.11

CNA Affected

[
  {
    "product": "PHP",
    "vendor": "PHP Group",
    "versions": [
      {
        "lessThan": "7.3.23",
        "status": "affected",
        "version": "7.3.x",
        "versionType": "custom"
      },
      {
        "lessThan": "7.4.11",
        "status": "affected",
        "version": "7.4.x",
        "versionType": "custom"
      },
      {
        "lessThan": "7.2.34",
        "status": "affected",
        "version": "7.2.x",
        "versionType": "custom"
      }
    ]
  }
]