Vulnerability · Published Oct 2, 2020 · Assigned by php

CVE-2020-7070PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Medium 4.3

In plain English

A medium-severity improper input validation in PHP from PHP Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.0% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)5.0%top 7.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	apcu-panel	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip-devel	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	libzip-tools	1.6.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-bcmath	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-cli	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-common	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-dba	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-dbg	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-devel	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-embedded	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-enchant	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-ffi	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-fpm	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-gd	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-gmp	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-intl	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-json	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-ldap	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-mbstring	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-mysqlnd	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-odbc	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-opcache	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-pdo	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-pear	1:1.10.12-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-apcu	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-apcu-devel	5.1.18-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.4.0+2229+b272fdef	ALSA-2021:4213
AlmaLinux:8	php-pecl-rrd	2.0.1-1.module_el8.3.0+2009+b272fdef	ALSA-2021:4213
AlmaLinux:8	php-pecl-xdebug	2.9.5-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pecl-zip	1.18.2-1.module_el8.6.0+2750+78feabcb	ALSA-2021:4213
AlmaLinux:8	php-pgsql	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-process	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-snmp	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-soap	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-xml	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
AlmaLinux:8	php-xmlrpc	7.4.19-3.module_el8.6.0+2976+8b9a0d08	ALSA-2021:4213
Rocky Linux:8	libzip	0:1.6.1-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	libzip	0:1.6.1-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php	0:7.4.19-1.module+el8.5.0+696+61e7c9ba	RLSA-2021:4213
Rocky Linux:8	php-pear	1:1.10.12-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pear	1:1.10.12-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-apcu	0:5.1.18-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-apcu	0:5.1.18-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pecl-rrd	0:2.0.1-1.module+el8.4.0+414+2e7afcdd	RLSA-2021:4213
Rocky Linux:8	php-pecl-xdebug	0:2.9.5-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213
Rocky Linux:8	php-pecl-zip	0:1.18.2-1.module+el8.6.0+789+2130c178	RLSA-2021:4213
Rocky Linux:8	php-pecl-zip	0:1.18.2-1.module+el8.4.0+415+e936cba3	RLSA-2021:4213

Affected products (as reported)

Vendor	Product	Versions
PHP Group	PHP	7.3.x – before 7.3.237.4.x – before 7.4.117.2.x – before 7.2.34

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://hackerone.com/reports/895727 x_refsource_MISC
https://bugs.php.net/bug.php?id=79699 x_refsource_MISC
http://cve.circl.lu/cve/CVE-2020-8184 x_refsource_MISC
FEDORA-2020-4573f0e03a vendor-advisory, x_refsource_FEDORA
[debian-lts-announce] 20201006 [SECURITY] [DLA 2397-1] php7.0 security update mailing-list, x_refsource_MLIST
FEDORA-2020-4fe6b116e5 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-94763cb98b vendor-advisory, x_refsource_FEDORA
openSUSE-SU-2020:1703 vendor-advisory, x_refsource_SUSE
USN-4583-1 vendor-advisory, x_refsource_UBUNTU
openSUSE-SU-2020:1767 vendor-advisory, x_refsource_SUSE
GLSA-202012-16 vendor-advisory, x_refsource_GENTOO
DSA-4856 vendor-advisory, x_refsource_DEBIAN
https://security.netapp.com/advisory/ntap-20201016-0001/ x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
https://www.tenable.com/security/tns-2021-14 x_refsource_CONFIRM