5.4
Medium
CVE-2020-7069 In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with…
Description
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
Affected products and versions
References
- bugs.php.net bugs.php.net
- FEDORA-2020-4573f0e03a lists.fedoraproject.org
- FEDORA-2020-4fe6b116e5 lists.fedoraproject.org
- FEDORA-2020-94763cb98b lists.fedoraproject.org
- openSUSE-SU-2020:1703 lists.opensuse.org
- USN-4583-1 usn.ubuntu.com
- openSUSE-SU-2020:1767 lists.opensuse.org
- GLSA-202012-16 security.gentoo.org
- DSA-4856 www.debian.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- www.oracle.com www.oracle.com
- www.tenable.com www.tenable.com
Timeline
- Published
- Last modified
Other CVEs of PHP
The 103 CVEs of PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critical
CVE-2026-109618
RCE via OOM corruption
9.2
Critical
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Medium
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Medium