Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-7070

Fixed in a distro release EPSS 5%CVSS 4.3

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Published 2020-10-02 · CVE record · OSV

Products: PHP Group PHP

Distro releases

ReleasePackageFixed in
AlmaLinux:8apcu-panel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip-devel1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8libzip-tools1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-bcmath7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-cli7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-common7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-dba7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-dbg7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-devel7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-embedded7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-enchant7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-ffi7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-fpm7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-gd7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-gmp7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-intl7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-json7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-ldap7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-mbstring7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-mysqlnd7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-odbc7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-opcache7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-pdo7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-pear1:1.10.12-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-apcu-devel5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux:8php-pecl-rrd2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux:8php-pecl-xdebug2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pecl-zip1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8php-pgsql7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-process7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-snmp7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-soap7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-xml7.4.19-3.module_el8.6.0+2976+8b9a0d08
AlmaLinux:8php-xmlrpc7.4.19-3.module_el8.6.0+2976+8b9a0d08
Debian:10php7.37.3.27-1~deb10u1
Debian:11php7.47.4.11-1
Debian:9php7.07.0.33-0+deb9u10
Red Hat:enterprise_linux:8apcu-panel0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip-debuginfo0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip-debugsource0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip-devel0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip-tools0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8libzip-tools-debuginfo0:1.6.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-bcmath0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-bcmath-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-cli0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-cli-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-common0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-common-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-dba0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-dba-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-dbg0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-dbg-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-debugsource0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-devel0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-embedded0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-embedded-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-enchant0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-enchant-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-ffi0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-ffi-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-fpm0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-fpm-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-gd0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-gd-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-gmp0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-gmp-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-intl0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-intl-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-json0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-json-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-ldap0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-ldap-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-mbstring0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-mbstring-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-mysqlnd0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-mysqlnd-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-odbc0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-odbc-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-opcache0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-opcache-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-pdo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-pdo-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-pear1:1.10.12-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-apcu0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-apcu-debuginfo0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-apcu-debugsource0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-apcu-devel0:5.1.18-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-rrd0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-rrd-debuginfo0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-rrd-debugsource0:2.0.1-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-xdebug0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-xdebug-debuginfo0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-xdebug-debugsource0:2.9.5-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-zip0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-zip-debuginfo0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pecl-zip-debugsource0:1.18.2-1.module+el8.3.0+6678+b09f589e
Red Hat:enterprise_linux:8php-pgsql0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-pgsql-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-process0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-process-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-snmp0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-snmp-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-soap0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-soap-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-xml0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-xml-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-xmlrpc0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:enterprise_linux:8php-xmlrpc-debuginfo0:7.4.19-1.module+el8.5.0+11143+cc873159
Red Hat:rhel_software_collections:3rh-php73-php0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-bcmath0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-cli0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-common0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-dba0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-dbg0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-debuginfo0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-devel0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-embedded0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-enchant0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-fpm0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-gd0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-gmp0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-intl0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-json0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-ldap0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-mbstring0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-mysqlnd0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-odbc0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-opcache0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-pdo0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-pgsql0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-process0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-pspell0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-recode0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-snmp0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-soap0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-xml0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-xmlrpc0:7.3.29-1.el7
Red Hat:rhel_software_collections:3rh-php73-php-zip0:7.3.29-1.el7
Rocky Linux:8libzip0:1.6.1-1.module+el8.6.0+789+2130c178
Rocky Linux:8libzip0:1.6.1-1.module+el8.4.0+415+e936cba3
Rocky Linux:8php0:7.4.19-1.module+el8.5.0+696+61e7c9ba
Rocky Linux:8php-pear1:1.10.12-1.module+el8.4.0+415+e936cba3
Rocky Linux:8php-pear1:1.10.12-1.module+el8.6.0+789+2130c178
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.4.0+415+e936cba3
Rocky Linux:8php-pecl-apcu0:5.1.18-1.module+el8.6.0+789+2130c178
Rocky Linux:8php-pecl-rrd0:2.0.1-1.module+el8.4.0+414+2e7afcdd
Rocky Linux:8php-pecl-xdebug0:2.9.5-1.module+el8.4.0+415+e936cba3
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.6.0+789+2130c178
Rocky Linux:8php-pecl-zip0:1.18.2-1.module+el8.4.0+415+e936cba3
SUSE:Enterprise Storage 6php77.2.34-150000.4.103.1
SUSE:Enterprise Storage 7php77.4.33-150200.3.46.2
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOSphp77.4.33-150200.3.46.2
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSSphp77.4.33-150200.3.46.2
SUSE:Linux Enterprise High Performance Computing 15-ESPOSphp77.2.5-4.67.2
SUSE:Linux Enterprise High Performance Computing 15-ESPOSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise High Performance Computing 15-LTSSphp77.2.5-4.67.2
SUSE:Linux Enterprise High Performance Computing 15-LTSSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise Module for Package Hub 15 SP1php77.2.5-4.67.2
SUSE:Linux Enterprise Module for Package Hub 15 SP2php77.4.6-3.11.1
SUSE:Linux Enterprise Module for Package Hub 15 SP3php77.4.33-150200.3.46.2
SUSE:Linux Enterprise Module for Web and Scripting 12php55.5.14-109.82.1
SUSE:Linux Enterprise Module for Web and Scripting 12php77.0.7-50.102.1
SUSE:Linux Enterprise Module for Web and Scripting 12php727.2.5-1.54.1
SUSE:Linux Enterprise Module for Web and Scripting 12php747.4.6-1.13.1
SUSE:Linux Enterprise Module for Web and Scripting 12php747.4.33-1.47.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1php77.2.5-4.67.2
SUSE:Linux Enterprise Module for Web and Scripting 15 SP2php77.4.6-3.11.1
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3php77.4.33-150200.3.46.2
SUSE:Linux Enterprise Point of Sale 11 SP3php535.3.17-112.93.1
SUSE:Linux Enterprise Server 11 SP4-LTSSphp535.3.17-112.93.1
SUSE:Linux Enterprise Server 15 SP1-BCLphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise Server 15 SP1-LTSSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise Server 15 SP2-BCLphp77.4.33-150200.3.46.2
SUSE:Linux Enterprise Server 15 SP2-LTSSphp77.4.33-150200.3.46.2
SUSE:Linux Enterprise Server 15-LTSSphp77.2.34-150000.4.103.1
SUSE:Linux Enterprise Server 15-LTSSphp77.2.5-4.67.2
SUSE:Linux Enterprise Server for SAP Applications 15php77.2.5-4.67.2
SUSE:Linux Enterprise Server for SAP Applications 15php77.2.34-150000.4.103.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP1php77.2.34-150000.4.103.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP2php77.4.33-150200.3.46.2
SUSE:Linux Enterprise Software Development Kit 12 SP5php77.0.7-50.102.1
SUSE:Linux Enterprise Software Development Kit 12 SP5php727.2.5-1.54.1
SUSE:Linux Enterprise Software Development Kit 12 SP5php747.4.33-1.47.2
SUSE:Linux Enterprise Software Development Kit 12 SP5php747.4.6-1.13.1
SUSE:Manager Proxy 4.1php77.4.33-150200.3.46.2
SUSE:Manager Retail Branch Server 4.1php77.4.33-150200.3.46.2
SUSE:Manager Server 4.1php77.4.33-150200.3.46.2
Ubuntu:16.04:LTSphp7.07.0.33-0ubuntu0.16.04.16
Ubuntu:18.04:LTSphp7.27.2.24-0ubuntu0.18.04.7
Ubuntu:20.04:LTSphp7.47.4.3-4ubuntu2.4
Ubuntu:Pro:14.04:LTSphp55.5.9+dfsg-1ubuntu4.29+esm13
openSUSE:Leap 15.1php77.2.5-lp151.6.36.7
openSUSE:Leap 15.1php7-test7.2.5-lp151.6.36.7
openSUSE:Leap 15.2php77.4.6-lp152.2.9.1
openSUSE:Leap 15.2php7-test7.4.6-lp152.2.9.1
openSUSE:Leap 15.3php77.4.33-150200.3.46.2
openSUSE:Leap 15.3php7-test7.4.33-150200.3.46.2
openSUSE:Leap 15.4php77.4.33-150200.3.46.2
openSUSE:Leap 15.4php77.2.34-150000.4.103.1