In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-xdebugUpgrade php-fpmUpgrade libzip-develUpgrade php-develUpgrade php-ldapUpgrade phpUpgrade php-bcmathUpgrade php-opcacheUpgrade php-pgsqlUpgrade php-pearUpgrade php-dbgUpgrade php-xmlUpgrade php-odbcUpgrade php-mysqlndUpgrade php-pdoUpgrade php-commonUpgrade php-pecl-apcuUpgrade php-cliUpgrade php-snmpUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-xmlrpcUpgrade php-ffiUpgrade php-jsonUpgrade php-gdUpgrade php-pecl-apcu-develUpgrade php-embeddedUpgrade apcu-panelUpgrade php-intlUpgrade php-pecl-zipUpgrade php-mbstringUpgrade php-gmpUpgrade php-processUpgrade php-enchantUpgrade php-dbaUpgrade libzipUpgrade libzip-tools | May 13, 2022 | Oct 2, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 2, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Jul 17, 2021 | Oct 2, 2020 |
| Centos_linux | — | Upgrade php-pecl-zipUpgrade apcu-panelUpgrade libzip-tools-debuginfoUpgrade php-commonUpgrade php-dba-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-enchant-debuginfoUpgrade php-gmp-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-process-debuginfoUpgrade php-intlUpgrade php-ffiUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-gmpUpgrade php-dbaUpgrade php-pecl-apcu-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-pgsqlUpgrade php-ffi-debuginfoUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-dbgUpgrade libzip-debuginfoUpgrade php-pdo-debuginfoUpgrade php-odbc-debuginfoUpgrade libzip-toolsUpgrade phpUpgrade php-debuginfoUpgrade php-ldapUpgrade php-soap-debuginfoUpgrade libzip-debugsourceUpgrade php-soapUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-cli-debuginfoUpgrade php-fpm-debuginfoUpgrade php-jsonUpgrade php-opcache-debuginfoUpgrade php-pearUpgrade php-pecl-rrd-debugsourceUpgrade php-embeddedUpgrade php-cliUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-snmp-debuginfoUpgrade php-gd-debuginfoUpgrade php-xmlUpgrade php-pecl-rrdUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-fpmUpgrade php-enchantUpgrade php-gdUpgrade php-develUpgrade php-pecl-rrd-debuginfoUpgrade php-intl-debuginfoUpgrade php-embedded-debuginfoUpgrade php-snmpUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebugUpgrade php-pdoUpgrade php-opcacheUpgrade libzipUpgrade php-mysqlndUpgrade php-process | Nov 10, 2021 | Oct 2, 2020 |
| Debian | — | Upgrade php7.4 | Feb 19, 2021 | Oct 2, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Dec 29, 2020 | Oct 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade phpUpgrade php-odbcUpgrade php-pdoUpgrade php-commonUpgrade php-ldapUpgrade php-soapUpgrade php-processUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-cliUpgrade php-gdUpgrade php-recodeUpgrade php-xml | Nov 3, 2020 | Oct 2, 2020 |
| Oracle Solaris | — | Upgrade web/php-74 to version 7.4.11-11.4.28.0.1.82.2 on Solaris 11.4Upgrade web/php-73 to version 7.3.23-11.4.28.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 2, 2020 |
| Oracle_linux | — | Upgrade libzip-toolsUpgrade php-mysqlndUpgrade php-xmlrpcUpgrade php-ffiUpgrade php-dbgUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-odbcUpgrade php-intlUpgrade php-snmpUpgrade php-commonUpgrade php-opcacheUpgrade libzip-develUpgrade php-cliUpgrade php-mbstringUpgrade apcu-panelUpgrade php-embeddedUpgrade php-jsonUpgrade php-soapUpgrade php-pdoUpgrade php-gdUpgrade php-ldapUpgrade php-pearUpgrade php-bcmathUpgrade php-pecl-xdebugUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-gmpUpgrade php-pgsqlUpgrade php-processUpgrade php-pecl-rrdUpgrade php-enchantUpgrade php-dbaUpgrade php-develUpgrade php-pecl-zipUpgrade php | Nov 17, 2021 | May 15, 2020 |
| Php | — | Upgrade to PHP version 7.3.23Upgrade to PHP version 7.4.11Upgrade to PHP version 7.2.34 | Oct 20, 2020 | Oct 2, 2020 |
| Redhat_linux | — | Upgrade php-soap-debuginfoUpgrade libzip-toolsUpgrade php-xmlUpgrade libzip-develUpgrade php-debuginfoUpgrade php-dbaUpgrade php-xmlrpcUpgrade php-mbstringUpgrade php-ffiUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-intlUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-mysqlnd-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-fpm-debuginfoUpgrade php-odbcUpgrade php-mysqlndUpgrade php-pgsqlUpgrade php-snmp-debuginfoUpgrade php-snmpUpgrade php-process-debuginfoUpgrade php-dbg-debuginfoUpgrade libzip-debuginfoUpgrade php-cliUpgrade php-opcacheUpgrade php-pecl-rrdUpgrade apcu-panelUpgrade php-xml-debuginfoUpgrade libzip-debugsourceUpgrade php-intl-debuginfoUpgrade php-common-debuginfoUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-dba-debuginfoUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade php-opcache-debuginfoNo solution existsUpgrade php-embeddedUpgrade php-debugsourceUpgrade php-ldapUpgrade php-mbstring-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-soapUpgrade php-pearUpgrade php-pecl-xdebug-debuginfoUpgrade php-ffi-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-odbc-debuginfoUpgrade php-develUpgrade php-bcmathUpgrade php-pecl-zipUpgrade php-fpmUpgrade php-pecl-apcu-develUpgrade php-json-debuginfoUpgrade php-pdo-debuginfoUpgrade php-gmpUpgrade php-jsonUpgrade php-pecl-xdebugUpgrade phpUpgrade php-enchantUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debugsourceUpgrade php-gmp-debuginfoUpgrade php-gdUpgrade php-enchant-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-pdoUpgrade libzipUpgrade php-embedded-debuginfoUpgrade php-gd-debuginfo | Nov 10, 2021 | Oct 2, 2020 |
| Rocky_linux | — | Upgrade libzip-develUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-mysqlnd-debuginfoUpgrade php-enchantUpgrade php-embedded-debuginfoUpgrade php-intl-debuginfoUpgrade php-xmlUpgrade php-fpmUpgrade php-xmlrpcUpgrade php-enchant-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-processUpgrade php-opcache-debuginfoUpgrade php-gmpUpgrade php-pecl-xdebugUpgrade php-cliUpgrade php-snmpUpgrade php-pecl-zip-debugsourceUpgrade php-snmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlndUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-jsonUpgrade php-develUpgrade php-pecl-zipUpgrade php-mbstringUpgrade php-dbg-debuginfoUpgrade php-pdoUpgrade php-pecl-apcu-debugsourceUpgrade php-dba-debuginfoUpgrade php-debuginfoUpgrade libzipUpgrade php-pecl-xdebug-debugsourceUpgrade php-soapUpgrade phpUpgrade php-process-debuginfoUpgrade php-odbcUpgrade php-dbaUpgrade php-intlUpgrade php-commonUpgrade php-cli-debuginfoUpgrade php-pecl-apcuUpgrade php-ldap-debuginfoUpgrade php-embeddedUpgrade php-bcmathUpgrade php-pecl-apcu-develUpgrade php-fpm-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbgUpgrade php-mbstring-debuginfoUpgrade php-ffiUpgrade php-ffi-debuginfoUpgrade php-pgsql-debuginfoUpgrade libzip-toolsUpgrade php-gd-debuginfoUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade php-ldapUpgrade libzip-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pdo-debuginfoUpgrade php-pecl-zip-debuginfoUpgrade php-pgsqlUpgrade php-debugsourceUpgrade php-bcmath-debuginfoUpgrade php-xml-debuginfoUpgrade php-gmp-debuginfoUpgrade php-json-debuginfoUpgrade php-common-debuginfoUpgrade libzip-debugsource | Mar 12, 2024 | Oct 2, 2020 |
| Suse | — | Upgrade php72-xslUpgrade php72-ftpUpgrade php74-calendarUpgrade php72-pharUpgrade php72-mbstringUpgrade php7-xmlrpcUpgrade php72-fileinfoUpgrade php72-gettextUpgrade php7-gmpUpgrade php74-soapUpgrade php7-firebirdUpgrade php74-pgsqlUpgrade apache2-mod_php72Upgrade php74-domUpgrade php74-fileinfoUpgrade php7-jsonUpgrade php7-pcntlUpgrade php72-gdUpgrade php7-pear-archive_tarUpgrade php7-opensslUpgrade php74-ldapUpgrade apache2-mod_php74Upgrade php72-calendarUpgrade php72-pdoUpgrade php74-intlUpgrade php72-exifUpgrade php7-xmlreaderUpgrade php72-zipUpgrade php7-odbcUpgrade php72-pear-archive_tarUpgrade php72-wddxUpgrade php74-tidyUpgrade php72-pearUpgrade php74-mbstringUpgrade php72-dbaUpgrade php72-iconvUpgrade php7-bz2Upgrade php72-sqliteUpgrade php7-sysvshmUpgrade php72-develUpgrade php72-intlUpgrade php7-calendarUpgrade php72-opensslUpgrade php74-zlibUpgrade php74-posixUpgrade php7-fileinfoUpgrade php74Upgrade php7-shmopUpgrade php72-sysvshmUpgrade php7-ldapUpgrade php72-sysvsemUpgrade php7-tidyUpgrade php7-readlineUpgrade php72-tidyUpgrade php74-dbaUpgrade php74-pharUpgrade php74-sysvsemUpgrade php74-sodiumUpgrade php7-domUpgrade php7-gdUpgrade php74-gmpUpgrade php7-mbstringUpgrade php74-xmlreaderUpgrade php7-dbaUpgrade php74-opensslUpgrade php7-sodiumUpgrade php7-develUpgrade php7-xslUpgrade php74-bcmathUpgrade php72-pcntlUpgrade php7Upgrade php74-xslUpgrade php72-opcacheUpgrade php7-opcacheUpgrade php7-bcmathUpgrade php72-fpmUpgrade php72-jsonUpgrade php74-sysvshmUpgrade php74-jsonUpgrade php72-snmpUpgrade php7-intlUpgrade php7-posixUpgrade php7-ctypeUpgrade php7-tokenizerUpgrade php74-socketsUpgrade php74-odbcUpgrade php74-fastcgiUpgrade php7-fpmUpgrade php74-snmpUpgrade php74-bz2Upgrade php72-bz2Upgrade php74-ctypeUpgrade php72-xmlreaderUpgrade php7-socketsUpgrade php7-pdoUpgrade php7-gettextUpgrade php72-sodiumUpgrade php72-readlineUpgrade php72-posixUpgrade php72-gmpUpgrade php72-domUpgrade php7-sysvmsgUpgrade php7-exifUpgrade php7-enchantUpgrade php74-opcacheUpgrade php74-zipUpgrade php74-shmopUpgrade php74-gdUpgrade php7-curlUpgrade php72-enchantUpgrade php72-curlUpgrade php7-wddxUpgrade php72-bcmathUpgrade php72-mysqlUpgrade php7-sysvsemUpgrade php74-pdoUpgrade php7-testUpgrade php74-xmlrpcUpgrade php72-socketsUpgrade php74-sqliteUpgrade php72-xmlrpcUpgrade apache2-mod_php7Upgrade php74-enchantUpgrade php74-develUpgrade php72-pspellUpgrade php72-pgsqlUpgrade php74-iconvUpgrade php72-xmlwriterUpgrade php72-sysvmsgUpgrade php72-ldapUpgrade php74-fpmUpgrade php74-readlineUpgrade php72Upgrade php7-snmpUpgrade php7-ftpUpgrade php7-embedUpgrade php74-sysvmsgUpgrade php74-exifUpgrade php74-tokenizerUpgrade php74-xmlwriterUpgrade php72-zlibUpgrade php74-ftpUpgrade php72-odbcUpgrade php72-fastcgiUpgrade php7-pgsqlUpgrade php7-xmlwriterUpgrade php72-shmopUpgrade php74-pcntlUpgrade php7-soapUpgrade php7-iconvUpgrade php7-pearUpgrade php72-tokenizerUpgrade php72-soapUpgrade php74-curlUpgrade php7-fastcgiUpgrade php7-pharUpgrade php74-mysqlUpgrade php74-gettextUpgrade php7-zipUpgrade php72-ctypeUpgrade php7-mysqlUpgrade php72-imapUpgrade php7-sqliteUpgrade php7-zlib | Feb 7, 2021 | Oct 2, 2020 |
| Ubuntu | — | Upgrade php7.2-curlUpgrade php7.2-cgiUpgrade php7.4-fpmUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.4Upgrade php7.2-cliUpgrade php7.2-fpmUpgrade php7.4-cgiUpgrade php7.4-cliUpgrade php7.4-curl | Mar 9, 2021 | Oct 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub