In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-rrdUpgrade libzip-toolsUpgrade php-intlUpgrade php-gdUpgrade phpUpgrade php-fpmUpgrade php-mysqlndUpgrade php-dbgUpgrade php-pecl-zipUpgrade php-jsonUpgrade php-soapUpgrade php-develUpgrade php-enchantUpgrade php-pdoUpgrade libzipUpgrade php-opcacheUpgrade php-pecl-apcu-develUpgrade apcu-panelUpgrade php-ldapUpgrade php-pecl-xdebugUpgrade php-embeddedUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-pgsqlUpgrade php-xmlUpgrade php-pearUpgrade php-dbaUpgrade php-xmlrpcUpgrade php-processUpgrade php-odbcUpgrade php-mbstringUpgrade php-cliUpgrade php-commonUpgrade php-snmpUpgrade php-ffiUpgrade libzip-devel | May 13, 2022 | Oct 2, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 2, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Jul 17, 2021 | Oct 2, 2020 |
| Centos_linux | — | Upgrade libzip-develUpgrade php-mbstringUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-snmpUpgrade php-intl-debuginfoUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-common-debuginfoUpgrade php-odbc-debuginfoUpgrade php-dbg-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-processUpgrade php-mysqlnd-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-cli-debuginfoUpgrade php-odbcUpgrade php-pearUpgrade php-xmlUpgrade php-xml-debuginfoUpgrade php-process-debuginfoUpgrade php-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-rrdUpgrade php-pecl-zip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade libzip-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebugUpgrade php-pgsqlUpgrade php-snmp-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-dbaUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmathUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-gd-debuginfoUpgrade php-fpmUpgrade libzipUpgrade php-ffi-debuginfoUpgrade php-ffiUpgrade apcu-panelUpgrade php-gmp-debuginfoUpgrade php-jsonUpgrade php-embeddedUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-fpm-debuginfoUpgrade php-enchantUpgrade php-develUpgrade php-dbgUpgrade phpUpgrade libzip-tools-debuginfoUpgrade php-gdUpgrade php-soapUpgrade php-mysqlndUpgrade php-bcmath-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-opcacheUpgrade php-cliUpgrade php-debugsourceUpgrade php-pgsql-debuginfoUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-intlUpgrade php-gmp | Nov 10, 2021 | Oct 2, 2020 |
| Debian | — | Upgrade php7.4 | Oct 8, 2020 | Oct 2, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Dec 29, 2020 | Oct 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-xmlUpgrade php-xmlrpcUpgrade php-cliUpgrade php-fpmUpgrade php-processUpgrade phpUpgrade php-recodeUpgrade php-pdoUpgrade php-commonUpgrade php-soapUpgrade php-odbcUpgrade php-ldapUpgrade php-gd | Nov 3, 2020 | Oct 2, 2020 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.23-11.4.28.0.1.82.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.11-11.4.28.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 2, 2020 |
| Oracle_linux | — | Upgrade php-dbaUpgrade php-enchantUpgrade phpUpgrade php-snmpUpgrade php-opcacheUpgrade php-pecl-zipUpgrade libzipUpgrade php-gdUpgrade php-dbgUpgrade php-embeddedUpgrade php-bcmathUpgrade php-ffiUpgrade php-pecl-apcuUpgrade php-intlUpgrade php-mysqlndUpgrade php-ldapUpgrade apcu-panelUpgrade libzip-toolsUpgrade php-xmlUpgrade libzip-develUpgrade php-cliUpgrade php-mbstringUpgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-pecl-apcu-develUpgrade php-gmpUpgrade php-xmlrpcUpgrade php-soapUpgrade php-pdoUpgrade php-develUpgrade php-odbcUpgrade php-processUpgrade php-pearUpgrade php-commonUpgrade php-fpmUpgrade php-pgsqlUpgrade php-pecl-rrd | Nov 17, 2021 | Jun 14, 2020 |
| Php | — | Upgrade to PHP version 7.3.23Upgrade to PHP version 7.4.11Upgrade to PHP version 7.2.34 | Oct 20, 2020 | Oct 2, 2020 |
| Redhat_linux | — | Upgrade php-mysqlnd-debuginfoUpgrade php-pecl-xdebugUpgrade php-intl-debuginfoUpgrade php-enchant-debuginfoUpgrade php-odbcUpgrade php-mbstringUpgrade php-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-xml-debuginfoUpgrade libzip-toolsUpgrade libzip-debuginfoUpgrade php-ldap-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-dbgUpgrade php-snmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-apcuUpgrade php-fpm-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-json-debuginfoUpgrade php-pgsqlUpgrade php-snmpUpgrade php-commonUpgrade php-pecl-zip-debuginfoUpgrade php-common-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-odbc-debuginfoNo solution existsUpgrade php-opcache-debuginfoUpgrade libzip-develUpgrade php-pecl-apcu-debugsourceUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-pecl-rrd-debugsourceUpgrade php-ffi-debuginfoUpgrade php-embedded-debuginfoUpgrade php-dbg-debuginfoUpgrade php-bcmathUpgrade php-pecl-zip-debugsourceUpgrade php-dbaUpgrade php-opcacheUpgrade libzip-tools-debuginfoUpgrade phpUpgrade php-pgsql-debuginfoUpgrade php-intlUpgrade php-pecl-apcu-debuginfoUpgrade php-enchantUpgrade php-gd-debuginfoUpgrade php-debugsourceUpgrade php-soapUpgrade php-cliUpgrade php-pecl-zipUpgrade php-develUpgrade libzip-debugsourceUpgrade php-mysqlndUpgrade php-pecl-xdebug-debuginfoUpgrade php-cli-debuginfoUpgrade php-pdoUpgrade php-ffiUpgrade php-pdo-debuginfoUpgrade php-fpmUpgrade php-gmp-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-jsonUpgrade php-gdUpgrade php-gmpUpgrade php-pecl-apcu-develUpgrade libzipUpgrade php-ldapUpgrade apcu-panelUpgrade php-embeddedUpgrade php-process-debuginfoUpgrade php-processUpgrade php-pecl-rrdUpgrade php-pear | Nov 10, 2021 | Oct 2, 2020 |
| Rocky_linux | — | Upgrade php-gd-debuginfoUpgrade php-opcacheUpgrade php-processUpgrade libzip-develUpgrade php-xmlUpgrade php-embeddedUpgrade php-enchantUpgrade php-bcmath-debuginfoUpgrade php-pdoUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade php-bcmathUpgrade php-cliUpgrade php-pecl-apcu-debuginfoUpgrade php-dbg-debuginfoUpgrade php-intlUpgrade php-mysqlndUpgrade php-pecl-xdebug-debuginfoUpgrade phpUpgrade php-pecl-apcuUpgrade php-ffi-debuginfoUpgrade php-gdUpgrade php-ldapUpgrade php-gmp-debuginfoUpgrade php-soap-debuginfoUpgrade libzip-tools-debuginfoUpgrade libzip-toolsUpgrade php-debugsourceUpgrade php-pecl-zipUpgrade libzip-debugsourceUpgrade php-embedded-debuginfoUpgrade php-snmpUpgrade php-ffiUpgrade php-soapUpgrade php-dbaUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-rrdUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-mbstringUpgrade php-gmpUpgrade php-pecl-zip-debuginfoUpgrade php-fpm-debuginfoUpgrade php-develUpgrade php-dba-debuginfoUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-apcu-develUpgrade php-odbcUpgrade php-dbgUpgrade php-odbc-debuginfoUpgrade php-cli-debuginfoUpgrade php-pecl-xdebugUpgrade php-process-debuginfoUpgrade php-intl-debuginfoUpgrade php-json-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-opcache-debuginfoUpgrade php-fpmUpgrade libzip-debuginfoUpgrade php-snmp-debuginfoUpgrade php-debuginfoUpgrade php-jsonUpgrade php-ldap-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-enchant-debuginfoUpgrade php-common-debuginfoUpgrade php-pdo-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-xmlrpcUpgrade php-pgsql | Mar 12, 2024 | Oct 2, 2020 |
| Suse | — | Upgrade php7-fileinfoUpgrade apache2-mod_php74Upgrade php5-posixUpgrade php72-pspellUpgrade php7-readlineUpgrade php53-sysvsemUpgrade php5-fpmUpgrade php7-pspellUpgrade php5-zlibUpgrade php53-pspellUpgrade apache2-mod_php72Upgrade php74-fileinfoUpgrade php7-xmlwriterUpgrade php74-iconvUpgrade php74-snmpUpgrade php74-dbaUpgrade php74-tidyUpgrade php53-pgsqlUpgrade php5-sysvmsgUpgrade php7-ftpUpgrade php7-iconvUpgrade php72-intlUpgrade php72-imapUpgrade php7-pearUpgrade php72-iconvUpgrade php74-ldapUpgrade php7-ctypeUpgrade php72-ldapUpgrade php72-calendarUpgrade php5-xslUpgrade php7-zlibUpgrade php5-exifUpgrade php72-soapUpgrade php5-gdUpgrade php74-opcacheUpgrade php5-domUpgrade php72-fastcgiUpgrade php53-xmlrpcUpgrade php72-gettextUpgrade php7-snmpUpgrade php5-iconvUpgrade php7-testUpgrade php53-exifUpgrade php5-sysvshmUpgrade php5-tokenizerUpgrade php74-sysvshmUpgrade php7-fastcgiUpgrade php7-bcmathUpgrade php7-shmopUpgrade php74-odbcUpgrade php5-dbaUpgrade php53-jsonUpgrade php53-opensslUpgrade php53-wddxUpgrade php5-suhosinUpgrade php7-curlUpgrade php72-pearUpgrade php72-ftpUpgrade php5-intlUpgrade php5-enchantUpgrade php74-mysqlUpgrade php74-shmopUpgrade php74-pdoUpgrade php7-develUpgrade php53-intlUpgrade php74-curlUpgrade php72-develUpgrade php7-enchantUpgrade php72-pharUpgrade php74Upgrade php72-enchantUpgrade php74-gdUpgrade php7-tokenizerUpgrade php74-fpmUpgrade php7-mysqlUpgrade php5-fileinfoUpgrade php72-wddxUpgrade php72-domUpgrade php7-wddxUpgrade php7-jsonUpgrade php7-calendarUpgrade php7-odbcUpgrade php7-ldapUpgrade php5-socketsUpgrade php74-sqliteUpgrade php53-mysqlUpgrade php74-fastcgiUpgrade php5-curlUpgrade php72-tidyUpgrade php72-xslUpgrade php5-xmlrpcUpgrade apache2-mod_php5Upgrade php53-bz2Upgrade php74-sodiumUpgrade php5-sqliteUpgrade php7-zipUpgrade php72-socketsUpgrade php72-odbcUpgrade php5-ldapUpgrade php72-jsonUpgrade php72-dbaUpgrade php5-opcacheUpgrade php53-tokenizerUpgrade php53-gmpUpgrade php72-pear-archive_tarUpgrade php7-sysvshmUpgrade php53-ldapUpgrade php72-opcacheUpgrade php53-soapUpgrade php5-pgsqlUpgrade php53-sysvmsgUpgrade php53-xslUpgrade php74-develUpgrade php7-sysvsemUpgrade apache2-mod_php53Upgrade php72-sqliteUpgrade php53-domUpgrade php7-mcryptUpgrade php72-tokenizerUpgrade php5-pspellUpgrade php5-mbstringUpgrade php74-pcntlUpgrade php74-domUpgrade php5-ctypeUpgrade php7-pharUpgrade php72-opensslUpgrade php72-gmpUpgrade php72-zipUpgrade php53-fastcgiUpgrade php74-zlibUpgrade php7-gmpUpgrade php7-bz2Upgrade php53-calendarUpgrade php53-pearUpgrade php74-ftpUpgrade php7-sqliteUpgrade php7-gdUpgrade php74-mbstringUpgrade php7-tidyUpgrade php53-shmopUpgrade php72Upgrade php7-pgsqlUpgrade php53-iconvUpgrade php74-pgsqlUpgrade php72-xmlrpcUpgrade php5-soapUpgrade php74-intlUpgrade php72-sysvmsgUpgrade php72-xmlreaderUpgrade php53-bcmathUpgrade php5-bcmathUpgrade php74-bz2Upgrade php74-gmpUpgrade php74-opensslUpgrade php5-fastcgiUpgrade php72-shmopUpgrade php72-readlineUpgrade php7-dbaUpgrade php53-zlibUpgrade php7-posixUpgrade php72-gdUpgrade php72-mbstringUpgrade php72-pcntlUpgrade php5-odbcUpgrade php7-xmlrpcUpgrade php72-curlUpgrade php74-sysvsemUpgrade php74-xmlrpcUpgrade apache2-mod_php7Upgrade php7-opcacheUpgrade php7-xmlreaderUpgrade php74-calendarUpgrade php74-posixUpgrade php7-soapUpgrade php72-sodiumUpgrade php5-mysqlUpgrade php7-firebirdUpgrade php72-ctypeUpgrade php5-pharUpgrade php53-curlUpgrade php5Upgrade php74-bcmathUpgrade php74-xslUpgrade php74-xmlwriterUpgrade php72-snmpUpgrade php72-pdoUpgrade php7-fpmUpgrade php72-mysqlUpgrade php7-opensslUpgrade php5-wddxUpgrade php7-pdoUpgrade php7-imapUpgrade php53-zipUpgrade php53-snmpUpgrade php53-pdoUpgrade php53-gdUpgrade php53-odbcUpgrade php5-imapUpgrade php53-mbstringUpgrade php7-pear-archive_tarUpgrade php5-bz2Upgrade php74-pharUpgrade php74-exifUpgrade php72-fpmUpgrade php72-bz2Upgrade php7-sodiumUpgrade php53-gettextUpgrade php53Upgrade php72-exifUpgrade php72-sysvshmUpgrade php74-readlineUpgrade php7-exifUpgrade php53-fileinfoUpgrade php74-xmlreaderUpgrade php5-calendarUpgrade php72-zlibUpgrade php7-intlUpgrade php53-xmlreaderUpgrade php5-pdoUpgrade php72-sysvsemUpgrade php72-pgsqlUpgrade php74-gettextUpgrade php5-pearUpgrade php7-embedUpgrade php5-xmlwriterUpgrade php53-mcryptUpgrade php74-socketsUpgrade php72-bcmathUpgrade php7Upgrade php5-ftpUpgrade php74-enchantUpgrade php53-pcntlUpgrade php74-ctypeUpgrade php5-pcntlUpgrade php7-mbstringUpgrade php53-sysvshmUpgrade php7-socketsUpgrade php53-ctypeUpgrade php72-xmlwriterUpgrade php7-xslUpgrade php7-gettextUpgrade php53-ftpUpgrade php72-fileinfoUpgrade php5-snmpUpgrade php5-sysvsemUpgrade php53-xmlwriterUpgrade php74-jsonUpgrade php5-xmlreaderUpgrade php7-sysvmsgUpgrade php7-domUpgrade php74-zipUpgrade php74-tokenizerUpgrade php5-jsonUpgrade php7-pcntlUpgrade php74-soapUpgrade php53-suhosinUpgrade php53-dbaUpgrade php5-gmpUpgrade php74-sysvmsgUpgrade php5-zipUpgrade php5-shmopUpgrade php5-mcryptUpgrade php5-opensslUpgrade php5-gettextUpgrade php72-posix | Feb 7, 2021 | Oct 2, 2020 |
| Ubuntu | — | Upgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-curlUpgrade php5-curl (Ubuntu Pro)Upgrade php7.2-cgiUpgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.0Upgrade php7.0-cliUpgrade php5-curlUpgrade php5-fpmUpgrade php7.4-cgiUpgrade php7.4-cliUpgrade libapache2-mod-php7.4Upgrade php7.2-fpmUpgrade php7.0-curlUpgrade php5-cli (Ubuntu Pro)Upgrade php7.0-cgiUpgrade libapache2-mod-php5Upgrade php5-cliUpgrade php7.2-cliUpgrade php7.0-fpmUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade php5-cgi (Ubuntu Pro)Upgrade php7.4-curlUpgrade php5-cgiUpgrade php7.4-fpm | Mar 9, 2021 | Oct 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub