CVE-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
Attackers can forge secure cookies by exploiting URL decoding of cookie names, bypassing __Host- prefix protections in PHP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7070?
CVE-2020-7070 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 2 Oct 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
Which versions are affected by CVE-2020-7070?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 7 products.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 7.2.0 | 7.2.34, 7.3.23, 7.4.11 |
php Bitnami | From 7.2.0 | 7.2.34, 7.3.23, 7.4.11 |
php-min Bitnami | From 7.2.0 | 7.2.34, 7.3.23, 7.4.11 |
Linux distribution packages (5)
php5 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 5.5.14-109.82.1 |
php7 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 7.0.7-50.102.1 |
php53 SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 5.3.17-112.93.1 |
php53 SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 5.3.17-112.93.1 |
php7 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 7.0.7-50.102.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Netapp Clustered Data Ontap, Opensuse Leap, Php Php and 1 more.
How do I fix CVE-2020-7070?
Upgrade libphp to a fixed version for your release line: 7.2.34, 7.3.23 or 7.4.11.
Is CVE-2020-7070 being exploited?
There is no known exploitation of CVE-2020-7070 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as BIT-libphp-2020-7070, BIT-php-2020-7070, BIT-php-min-2020-7070, DEBIAN-CVE-2020-7070, DLA-2397-1, GHSA-j7r5-hm2w-qqf9 and 5 more.