NetSight
IP …
medium5.4

CVE-2020-7069

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only…

Impact

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Affected products

VendorProductAffected versions
PhpPhp
from 7.2.0 before 7.2.34
from 7.3.0 before 7.3.23
from 7.4.0 before 7.4.11
FedoraprojectFedora
Versions 31, 32, 33
DebianDebian Linux
Version 10.0
OpensuseLeap
Versions 15.1, 15.2
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 20.04
NetappClustered Data Ontap
All versions
OracleCommunications Diameter Signaling Router
from 8.0.0 through 8.5.0
TenableTenable.Sc
before 5.19.0

Weakness classification

CWE-20CWE-326

References