Lucene search
Veracode Vulnerability DatabaseVERACODE:26195HistoryAug 06, 2020 - 9:35 p.m.
NULL Byte Injection
2020-08-0621:35:31
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
30
php7
null byte injection
get_headers()
user-supplied url
software vulnerability
confidential information
EPSS
0.004
Percentile
74.8%
PHP7 is vulnerable to NULL byte injection. While using get_headers() with user-supplied URL, if the URL contains null byte \0, the URL will be silently truncated. This causes certain software to make incorrect assumptions about the target of the get_headers() and potentially send confidential information to a wrong server.
References
lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html
bugs.php.net/bug.php?id=79329
lists.debian.org/debian-lts-announce/2020/04/msg00021.html
security.netapp.com/advisory/ntap-20200403-0001/
usn.ubuntu.com/4330-2/
www.debian.org/security/2020/dsa-4717
www.debian.org/security/2020/dsa-4719
www.tenable.com/security/tns-2021-14
Related
debiancve
debiancve
CVE-2020-7066
2020-04-01 04:15:14
prion
prion
Code injection
2020-04-01 04:15:00
nvd
nvd
CVE-2020-7066
2020-04-01 04:15:14
cve
cve
CVE-2020-7066
2020-04-01 04:15:14
redhatcve
redhatcve
CVE-2020-7066
2020-04-03 13:01:29
ubuntucve
ubuntucve
CVE-2020-7066
2020-04-01 00:00:00
checkpoint_advisories
checkpoint_advisories
PHP get_headers Information Disclosure (CVE-2020-7066)
2020-04-16 00:00:00
alpinelinux
alpinelinux
CVE-2020-7066
2020-04-01 04:15:14
osv
osv
BIT-php-2020-7066
2024-03-06 11:06:42
CVE-2020-7066
2020-04-01 04:15:14
php5 - security update
2020-04-26 00:00:00
f5
f5
K17457324 : PHP vulnerability CVE-2020-7066
2020-04-05 00:00:00
cvelist
cvelist
CVE-2020-7066 get_headers() silently truncates after a null byte
2020-04-01 03:35:14
nessus
nessus
openSUSE Security Update : php7 (openSUSE-2020-642)
2020-05-11 00:00:00
EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1586)
2020-05-26 00:00:00
PHP 7.2.x < 7.2.29 Multiple Vulnerabilities
2020-03-27 00:00:00
openvas
openvas
PHP < 7.2.29 Multiple Vulnerabilities (Mar 2020) - Linux
2020-03-20 00:00:00
SUSE: Security Advisory (SUSE-SU-2020:1199-1)
2021-06-09 00:00:00
PHP < 7.2.29 Multiple Vulnerabilities (Mar 2020) - Windows
2020-03-20 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package php7 version 7.2.29-alt1
2020-03-27 00:00:00
Security fix for the ALT Linux 10 package php8.0 version 7.3.16-alt1
2020-03-24 00:00:00
Security fix for the ALT Linux 10 package php8.1 version 7.3.16-alt1
2020-03-24 00:00:00
suse
suse
Security update for php7 (moderate)
2020-05-11 00:00:00
ibm
ibm
mageia
mageia
Updated php packages fix security vulnerability
2020-04-01 04:56:57
fedora
fedora
[SECURITY] Fedora 30 Update: php-7.3.16-1.fc30
2020-03-26 09:48:08
[SECURITY] Fedora 32 Update: php-7.4.4-1.fc32
2020-03-25 16:17:12
[SECURITY] Fedora 31 Update: php-7.3.16-1.fc31
2020-03-26 01:20:28
amazon
amazon
Medium: php72
2020-05-08 20:28:00
Medium: php73
2020-05-08 20:29:00
ubuntu
ubuntu
PHP vulnerabilities
2020-05-06 00:00:00
PHP vulnerabilities
2020-04-15 00:00:00
debian
debian
[SECURITY] [DLA 2188-1] php5 security update
2020-04-26 14:08:10
[SECURITY] [DSA 4717-1] php7.0 security update
2020-07-05 14:35:07
[SECURITY] [DSA 4717-1] php7.0 security update
2020-07-05 14:35:07
gentoo
gentoo
PHP: Multiple vulnerabilities
2020-03-26 00:00:00
redhat
redhat
oraclelinux
oraclelinux
php:7.3 security, bug fix, and enhancement update
2020-09-09 00:00:00
almalinux
almalinux
Moderate: php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31
rocky
rocky
php:7.3 security, bug fix, and enhancement update
2020-09-08 08:38:31