CVE-2020-7069 MEDIUM

CVE-2020-7069: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

Vendor Php Group
Product PHP
Weakness CWE-20 · Input validation
Published October 2, 2020
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Key dates

02Disclosure timeline

October 2, 2020 CVE published
September 17, 2024 Record updated