Vulnerability · Published Oct 2, 2020 · Assigned by php

CVE-2020-7069Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

Medium 5.4

In plain English

A medium-severity improper input validation in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)2.1%top 18.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	apcu-panel	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip-devel	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip-tools	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-bcmath	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-cli	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-common	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-dba	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-dbg	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-devel	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-embedded	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-enchant	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-ffi	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-fpm	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-gd	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-gmp	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-intl	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-json	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-ldap	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-mbstring	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-mysqlnd	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-odbc	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-opcache	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-pdo	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-pear	1:1.10.12-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-apcu	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-apcu-devel	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.4.0+2229+b272fdef	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.3.0+2009+b272fdef	ALSA-2021:4213
AlmaLinux:8	php-pecl-xdebug	2.9.5-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-zip	1.18.2-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pgsql	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-process	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-snmp	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-soap	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-xml	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-xmlrpc	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
Rocky Linux:8	libzip	0:1.6.1-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	libzip	0:1.6.1-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php	0:7.4.19-1.module+el8.5.0+696+61e7c9ba	RLSA-2021:4213
Rocky Linux:8	php-pear	1:1.10.12-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pear	1:1.10.12-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-apcu	0:5.1.18-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-apcu	0:5.1.18-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pecl-rrd	0:2.0.1-1.module+el8.4.0+414+2e7afcdd	RLSA-2021:4213
Rocky Linux:8	php-pecl-xdebug	0:2.9.5-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pecl-zip	0:1.18.2-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-zip	0:1.18.2-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213

Affected products (as reported)

Vendor	Product	Versions
PHP Group	PHP	7.3.x – before 7.3.237.4.x – before 7.4.117.2.x – before 7.2.34

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://bugs.php.net/bug.php?id=79601 x_refsource_MISC
FEDORA-2020-4573f0e03a vendor-advisory, x_refsource_FEDORA
FEDORA-2020-4fe6b116e5 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-94763cb98b vendor-advisory, x_refsource_FEDORA
openSUSE-SU-2020:1703 vendor-advisory, x_refsource_SUSE
USN-4583-1 vendor-advisory, x_refsource_UBUNTU
openSUSE-SU-2020:1767 vendor-advisory, x_refsource_SUSE
GLSA-202012-16 vendor-advisory, x_refsource_GENTOO
DSA-4856 vendor-advisory, x_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
https://security.netapp.com/advisory/ntap-20201016-0001/ x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.tenable.com/security/tns-2021-14 x_refsource_CONFIRM