In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libzipUpgrade php-soapUpgrade php-mysqlndUpgrade php-develUpgrade apcu-panelUpgrade php-opcacheUpgrade php-pecl-zipUpgrade php-enchantUpgrade php-ldapUpgrade php-embeddedUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-intlUpgrade php-fpmUpgrade php-pecl-apcuUpgrade php-pecl-xdebugUpgrade php-bcmathUpgrade php-jsonUpgrade php-pdoUpgrade php-gmpUpgrade php-gdUpgrade php-mbstringUpgrade php-cliUpgrade php-dbaUpgrade php-pearUpgrade php-processUpgrade php-snmpUpgrade php-commonUpgrade libzip-develUpgrade php-xmlrpcUpgrade php-ffiUpgrade php-xmlUpgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-odbcUpgrade php-pgsql | May 13, 2022 | Oct 2, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 2, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Jul 17, 2021 | Oct 2, 2020 |
| Centos_linux | — | Upgrade php-enchantUpgrade php-mysqlndUpgrade php-dbgUpgrade php-cliUpgrade php-pgsql-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-embedded-debuginfoUpgrade php-gdUpgrade php-bcmathUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-opcacheUpgrade php-pecl-apcu-debuginfoUpgrade php-develUpgrade phpUpgrade php-debugsourceUpgrade php-ffiUpgrade php-pecl-apcuUpgrade php-fpm-debuginfoUpgrade php-pdoUpgrade php-pecl-rrd-debugsourceUpgrade libzipUpgrade php-fpmUpgrade php-gd-debuginfoUpgrade php-ldapUpgrade php-enchant-debuginfoUpgrade php-pecl-apcu-develUpgrade php-pecl-zipUpgrade php-intlUpgrade apcu-panelUpgrade php-gmpUpgrade php-gmp-debuginfoUpgrade php-ffi-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade libzip-debugsourceUpgrade php-dbaUpgrade php-embeddedUpgrade php-jsonUpgrade php-pecl-zip-debuginfoUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-dbg-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade php-mysqlnd-debuginfoUpgrade libzip-toolsUpgrade php-pearUpgrade php-odbc-debuginfoUpgrade php-common-debuginfoUpgrade php-mbstringUpgrade php-snmp-debuginfoUpgrade php-pdo-debuginfoUpgrade php-snmpUpgrade php-dba-debuginfoUpgrade php-odbcUpgrade php-xmlrpcUpgrade php-soap-debuginfoUpgrade php-mbstring-debuginfoUpgrade libzip-develUpgrade php-intl-debuginfoUpgrade php-pecl-xdebugUpgrade php-opcache-debuginfoUpgrade php-debuginfoUpgrade php-cli-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debugsourceUpgrade libzip-debuginfoUpgrade php-processUpgrade php-pecl-rrd-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-process-debuginfo | Nov 10, 2021 | Oct 2, 2020 |
| Debian | — | Upgrade php7.4 | Oct 8, 2020 | Oct 2, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Dec 29, 2020 | Oct 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade phpUpgrade php-recodeUpgrade php-processUpgrade php-xmlrpcUpgrade php-xmlUpgrade php-fpmUpgrade php-cliUpgrade php-gdUpgrade php-ldapUpgrade php-pdoUpgrade php-odbcUpgrade php-commonUpgrade php-soap | Nov 3, 2020 | Oct 2, 2020 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.23-11.4.28.0.1.82.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.11-11.4.28.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 2, 2020 |
| Oracle_linux | — | Upgrade php-ffiUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-xmlUpgrade php-dbaUpgrade libzip-develUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-pecl-zipUpgrade php-snmpUpgrade php-embeddedUpgrade phpUpgrade php-opcacheUpgrade php-cliUpgrade php-dbgUpgrade php-ldapUpgrade php-mysqlndUpgrade php-enchantUpgrade libzipUpgrade php-gdUpgrade php-bcmathUpgrade php-pearUpgrade php-pecl-apcu-develUpgrade php-pecl-rrdUpgrade php-odbcUpgrade php-commonUpgrade php-soapUpgrade php-pdoUpgrade php-jsonUpgrade php-xmlrpcUpgrade php-develUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-gmpUpgrade php-fpmUpgrade php-mbstringUpgrade php-process | Nov 17, 2021 | Jun 14, 2020 |
| Php | — | Upgrade to PHP version 7.4.11Upgrade to PHP version 7.2.34Upgrade to PHP version 7.3.23 | Oct 20, 2020 | Oct 2, 2020 |
| Redhat_linux | — | Upgrade php-fpm-debuginfoUpgrade php-commonUpgrade php-odbc-debuginfoNo solution existsUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-snmp-debuginfoUpgrade php-ldap-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-snmpUpgrade php-mbstring-debuginfoUpgrade php-pecl-apcuUpgrade php-opcache-debuginfoUpgrade php-xmlrpcUpgrade php-dba-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-xml-debuginfoUpgrade libzip-develUpgrade php-xmlUpgrade php-pgsqlUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-intl-debuginfoUpgrade php-debuginfoUpgrade php-mbstringUpgrade libzip-toolsUpgrade php-common-debuginfoUpgrade php-json-debuginfoUpgrade php-enchant-debuginfoUpgrade php-dbgUpgrade php-odbcUpgrade php-pecl-xdebugUpgrade libzip-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-debugsourceUpgrade php-pdo-debuginfoUpgrade php-jsonUpgrade php-dbg-debuginfoUpgrade php-bcmathUpgrade php-pdoUpgrade php-xmlrpc-debuginfoUpgrade php-ffiUpgrade libzip-debugsourceUpgrade php-ldapUpgrade php-cli-debuginfoUpgrade libzipUpgrade php-pecl-apcu-develUpgrade apcu-panelUpgrade php-mysqlndUpgrade php-pecl-zipUpgrade php-cliUpgrade php-ffi-debuginfoUpgrade phpUpgrade libzip-tools-debuginfoUpgrade php-intlUpgrade php-enchantUpgrade php-pecl-rrdUpgrade php-gd-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-gmp-debuginfoUpgrade php-fpmUpgrade php-embedded-debuginfoUpgrade php-processUpgrade php-pecl-rrd-debugsourceUpgrade php-dbaUpgrade php-opcacheUpgrade php-pearUpgrade php-gmpUpgrade php-gdUpgrade php-soapUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-devel | Nov 10, 2021 | Oct 2, 2020 |
| Rocky_linux | — | Upgrade php-soapUpgrade php-soap-debuginfoUpgrade libzip-toolsUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-ffi-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-pecl-rrdUpgrade php-dbaUpgrade php-cliUpgrade php-pecl-xdebug-debuginfoUpgrade php-embedded-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade phpUpgrade php-pecl-apcuUpgrade php-gd-debuginfoUpgrade php-embeddedUpgrade php-pecl-apcu-debuginfoUpgrade php-enchantUpgrade php-xmlUpgrade php-bcmathUpgrade libzip-develUpgrade php-intlUpgrade php-pdoUpgrade php-dbg-debuginfoUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade php-snmpUpgrade php-gdUpgrade php-pecl-rrd-debugsourceUpgrade php-debugsourceUpgrade libzipUpgrade php-gmp-debuginfoUpgrade libzip-debugsourceUpgrade php-ffiUpgrade php-processUpgrade php-gmpUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-debuginfoUpgrade php-mbstringUpgrade php-enchant-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-develUpgrade php-dba-debuginfoUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-process-debuginfoUpgrade php-odbc-debuginfoUpgrade php-intl-debuginfoUpgrade php-dbgUpgrade php-cli-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-snmp-debuginfoUpgrade php-fpmUpgrade php-odbcUpgrade php-mbstring-debuginfoUpgrade php-common-debuginfoUpgrade php-pdo-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-commonUpgrade php-xml-debuginfoUpgrade php-ldap-debuginfoUpgrade php-json | Mar 12, 2024 | Oct 2, 2020 |
| Suse | — | Upgrade php5-gettextUpgrade php53-dbaUpgrade php74-bcmathUpgrade php5-sysvsemUpgrade php5-bcmathUpgrade php53-mbstringUpgrade php74-exifUpgrade php74-mbstringUpgrade php72-pdoUpgrade php53-calendarUpgrade apache2-mod_php7Upgrade php53-xmlwriterUpgrade php7-opcacheUpgrade php5-fastcgiUpgrade php53-fileinfoUpgrade php53-sysvshmUpgrade php74-bz2Upgrade php74-zipUpgrade php72-sysvmsgUpgrade php72-xmlreaderUpgrade php7-dbaUpgrade php74-intlUpgrade php72-mbstringUpgrade php7-socketsUpgrade php7-mbstringUpgrade php53-shmopUpgrade php7-sqliteUpgrade php72-gdUpgrade php72Upgrade php74-readlineUpgrade php53-gdUpgrade php53-bcmathUpgrade php53-pearUpgrade php53-suhosinUpgrade php72-sysvsemUpgrade php72-posixUpgrade php72-shmopUpgrade php72-curlUpgrade php7-xmlrpcUpgrade php7-gmpUpgrade php5-imapUpgrade php53-pdoUpgrade php5-jsonUpgrade php72-snmpUpgrade php72-mysqlUpgrade php7-exifUpgrade php74-calendarUpgrade php7-pcntlUpgrade php7-bz2Upgrade php74-zlibUpgrade php74-opensslUpgrade php74-sysvsemUpgrade php7-opensslUpgrade php7-intlUpgrade php74-pharUpgrade php72-bz2Upgrade php5-wddxUpgrade php7-pdoUpgrade php7-sodiumUpgrade php7-domUpgrade php5-shmopUpgrade php5-mysqlUpgrade php7-xslUpgrade php53-curlUpgrade php5-calendarUpgrade php5-xmlreaderUpgrade php7-sysvmsgUpgrade php72-ctypeUpgrade php74-tokenizerUpgrade php53-snmpUpgrade php72-pcntlUpgrade php74-xslUpgrade php53-odbcUpgrade php5-pdoUpgrade php5-opensslUpgrade php7-imapUpgrade php74-posixUpgrade php5-pharUpgrade php5-gmpUpgrade php72-fpmUpgrade php74-xmlwriterUpgrade php7-posixUpgrade php72-zlibUpgrade php7-pear-archive_tarUpgrade php5Upgrade php74-ftpUpgrade php74-sysvmsgUpgrade php53-zlibUpgrade php7Upgrade php5-bz2Upgrade php7-embedUpgrade php7-xmlreaderUpgrade php7-tidyUpgrade php72-pgsqlUpgrade php7-soapUpgrade php53-zipUpgrade php72-sodiumUpgrade php53-pcntlUpgrade php74-xmlrpcUpgrade php5-xmlwriterUpgrade php53-xmlreaderUpgrade php74-gmpUpgrade php7-fpmUpgrade php53Upgrade php72-bcmathUpgrade php5-ftpUpgrade php5-soapUpgrade php74-gettextUpgrade php72-exifUpgrade php5-odbcUpgrade php53-ftpUpgrade php53-fastcgiUpgrade php7-pgsqlUpgrade php72-readlineUpgrade php53-iconvUpgrade php53-mcryptUpgrade php74-soapUpgrade php5-pcntlUpgrade php5-pearUpgrade php72-zipUpgrade php72-xmlrpcUpgrade php74-jsonUpgrade php74-xmlreaderUpgrade php7-gdUpgrade php74-enchantUpgrade php74-pgsqlUpgrade php72-xmlwriterUpgrade php5-snmpUpgrade php5-mcryptUpgrade php5-zipUpgrade php7-firebirdUpgrade php72-fileinfoUpgrade php74-socketsUpgrade php53-ctypeUpgrade php53-gettextUpgrade php7-gettextUpgrade php74-ctypeUpgrade php72-sysvshmUpgrade php7-zipUpgrade php72-pharUpgrade php5-sqliteUpgrade php7-pharUpgrade php72-pspellUpgrade php7-zlibUpgrade php74-pcntlUpgrade php72-tidyUpgrade php74-pdoUpgrade php72-dbaUpgrade php72-tokenizerUpgrade php5-socketsUpgrade php72-soapUpgrade php72-ftpUpgrade php72-sqliteUpgrade php72-pearUpgrade php7-pearUpgrade php5-suhosinUpgrade php5-intlUpgrade php7-enchantUpgrade php7-curlUpgrade php53-opensslUpgrade php53-wddxUpgrade apache2-mod_php72Upgrade php53-bz2Upgrade php74-mysqlUpgrade php72-odbcUpgrade php53-sysvmsgUpgrade php74-ldapUpgrade php5-dbaUpgrade php74-odbcUpgrade php53-jsonUpgrade php53-gmpUpgrade php5-gdUpgrade php53-xslUpgrade php5-pgsqlUpgrade php74-sysvshmUpgrade php5-iconvUpgrade php7-fastcgiUpgrade php7-pspellUpgrade php7-xmlwriterUpgrade php53-sysvsemUpgrade apache2-mod_php74Upgrade php53-pspellUpgrade php74-fpmUpgrade php53-tokenizerUpgrade php72-opensslUpgrade php74-shmopUpgrade php74-dbaUpgrade php72-calendarUpgrade php5-sysvmsgUpgrade php5-ldapUpgrade php74-iconvUpgrade php5-mbstringUpgrade php5-opcacheUpgrade php72-jsonUpgrade php74Upgrade php7-tokenizerUpgrade php74-fileinfoUpgrade php5-domUpgrade php5-zlibUpgrade php5-pspellUpgrade php53-xmlrpcUpgrade php5-tokenizerUpgrade php72-iconvUpgrade php74-tidyUpgrade apache2-mod_php5Upgrade php72-enchantUpgrade php72-intlUpgrade php5-ctypeUpgrade php7-ftpUpgrade php7-shmopUpgrade php7-bcmathUpgrade php7-snmpUpgrade php5-posixUpgrade php74-curlUpgrade php74-gdUpgrade php72-develUpgrade php7-mysqlUpgrade php7-develUpgrade php72-gettextUpgrade apache2-mod_php53Upgrade php72-domUpgrade php74-sqliteUpgrade php74-sodiumUpgrade php74-fastcgiUpgrade php72-xslUpgrade php72-wddxUpgrade php7-wddxUpgrade php7-sysvshmUpgrade php7-ldapUpgrade php5-curlUpgrade php53-mysqlUpgrade php7-odbcUpgrade php7-readlineUpgrade php53-domUpgrade php5-xmlrpcUpgrade php7-calendarUpgrade php74-snmpUpgrade php72-ldapUpgrade php7-iconvUpgrade php74-opcacheUpgrade php72-fastcgiUpgrade php53-pgsqlUpgrade php53-exifUpgrade php5-sysvshmUpgrade php7-testUpgrade php5-fpmUpgrade php5-exifUpgrade php72-imapUpgrade php74-domUpgrade php72-pear-archive_tarUpgrade php7-sysvsemUpgrade php53-ldapUpgrade php72-opcacheUpgrade php72-socketsUpgrade php5-enchantUpgrade php7-ctypeUpgrade php5-fileinfoUpgrade php7-mcryptUpgrade php74-develUpgrade php53-soapUpgrade php72-gmpUpgrade php53-intlUpgrade php7-fileinfoUpgrade php7-jsonUpgrade php5-xsl | Feb 7, 2021 | Oct 2, 2020 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade php5-fpmUpgrade php7.2-cgiUpgrade php7.4-cgiUpgrade php5-curlUpgrade php5-curl (Ubuntu Pro)Upgrade php7.0-cliUpgrade libapache2-mod-php7.2Upgrade php7.2-curlUpgrade libapache2-mod-php7.0Upgrade php7.0-curlUpgrade php7.2-cliUpgrade libapache2-mod-php5Upgrade php7.4-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php7.0-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade php7.4-curlUpgrade php5-cgiUpgrade php5-cliUpgrade libapache2-mod-php7.4Upgrade php7.0-cgiUpgrade php7.2-fpmUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.4-cli | Mar 9, 2021 | Oct 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub