CVE-2020-7069

Published: Oct 2, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 3.9 / Impact: 2.5

Source: NVD

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Affected (17)

Products: Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · +5 more

Show all products

Php: Php · Fedoraproject: Fedora · Debian: Debian Linux · Opensuse: Leap · Canonical: Ubuntu Linux · Netapp: Clustered Data Ontap · Oracle: Communications Diameter Signaling Router · Tenable: Tenable.sc

1 product

1 product

1 product

1 product

1 product

1 product

Clustered Data Ontap

1 product

Communications Diameter Signaling Router

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 7.2.0 to 7.2.34
Php Php	From 7.3.0 to 7.3.23
Php Php	From 7.4.0 to 7.4.11

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Diameter Signaling Router	From 8.0.0 to 8.5.0

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	Before 5.19.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html

Source: security@php.net

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html

Source: security@php.net

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=79601

Source: security@php.net

Issue TrackingPatchVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/

Source: security@php.net

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/

Source: security@php.net

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/

Source: security@php.net

https://security.gentoo.org/glsa/202012-16

Source: security@php.net

Third Party Advisory

https://security.netapp.com/advisory/ntap-20201016-0001/

Source: security@php.net

Third Party Advisory

https://usn.ubuntu.com/4583-1/

Source: security@php.net

Third Party Advisory

https://www.debian.org/security/2021/dsa-4856

Source: security@php.net

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: security@php.net

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: security@php.net

PatchThird Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: security@php.net

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugs.php.net/bug.php?id=79601

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202012-16

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20201016-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4583-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2021/dsa-4856

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.