Skip to content
OpenAdvisories
Medium USN-4583-1 2 CVEs

php5, php7.0, php7.2, php7.4 vulnerabilities

Published Oct 14, 2020 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain encrypt ciphers.
An attacker could possibly use this issue to decrease security or cause
incorrect encryption data. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-7069)

It was discorevered that PHP incorrectly handled certain HTTP cookies.
An attacker could possibly use this issue to forge cookie which is supposed to
be secure. (CVE-2020-7070)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.33-0ubuntu0.16.04.16
Ubuntu · 18.04 LTS 18.04:LTS php7.2 7.2.24-0ubuntu0.18.04.7
Ubuntu · 20.04 LTS 20.04:LTS php7.4 7.4.3-4ubuntu2.4
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS php5 5.5.9+dfsg-1ubuntu4.29+esm13

Vulnerabilities 2

  • Medium 5.4
    CVE-2020-7069

    Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect en…

    PHP Group PHP php5 php7.2 Debian Ubuntu Alpine
  • Medium 4.3
    CVE-2020-7070

    PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

    In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such p…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-7069
  • report
    https://ubuntu.com/security/CVE-2020-7070