In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pecl-zipUpgrade php-fpmUpgrade php-gmpUpgrade apcu-panelUpgrade php-pecl-apcu-develUpgrade php-ldapUpgrade php-enchantUpgrade php-mysqlndUpgrade php-pecl-xdebugUpgrade php-intlUpgrade php-develUpgrade php-pdoUpgrade php-jsonUpgrade php-opcacheUpgrade php-dbgUpgrade php-gdUpgrade php-soapUpgrade php-embeddedUpgrade php-bcmathUpgrade libzipUpgrade php-pecl-apcuUpgrade phpUpgrade php-odbcUpgrade php-cliUpgrade php-dbaUpgrade php-pgsqlUpgrade libzip-toolsUpgrade php-xmlUpgrade php-xmlrpcUpgrade php-pecl-rrdUpgrade php-processUpgrade php-snmpUpgrade php-mbstringUpgrade libzip-develUpgrade php-pearUpgrade php-ffiUpgrade php-common | May 13, 2022 | Oct 2, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 2, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Jul 17, 2021 | Oct 2, 2020 |
| Centos_linux | — | Upgrade php-pgsqlUpgrade php-pecl-xdebugUpgrade php-cli-debuginfoUpgrade php-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pdo-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-xml-debuginfoUpgrade php-processUpgrade php-process-debuginfoUpgrade php-xmlUpgrade php-json-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-snmp-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstringUpgrade php-mbstring-debuginfoUpgrade php-xmlrpcUpgrade libzip-develUpgrade php-pecl-xdebug-debugsourceUpgrade php-snmpUpgrade php-odbcUpgrade php-intl-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-commonUpgrade libzip-toolsUpgrade php-odbc-debuginfoUpgrade php-common-debuginfoUpgrade php-dbg-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-pearUpgrade php-pecl-rrdUpgrade libzip-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-xmlrpc-debuginfoUpgrade php-gd-debuginfoUpgrade php-opcacheUpgrade libzip-debugsourceUpgrade php-pecl-apcu-debuginfoUpgrade php-bcmathUpgrade php-pecl-xdebug-debuginfoUpgrade php-dbgUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-pgsql-debuginfoUpgrade php-cliUpgrade php-bcmath-debuginfoUpgrade php-mysqlndUpgrade php-ldapUpgrade php-develUpgrade php-fpmUpgrade php-enchantUpgrade php-gdUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php-debugsourceUpgrade libzip-tools-debuginfoUpgrade php-gmp-debuginfoUpgrade libzipUpgrade php-intlUpgrade php-soapUpgrade php-ffiUpgrade apcu-panelUpgrade php-ffi-debuginfoUpgrade php-gmpUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-zipUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-fpm-debuginfoUpgrade php-jsonUpgrade php-embeddedUpgrade php-dba | Nov 10, 2021 | Oct 2, 2020 |
| Debian | — | Upgrade php7.4 | Oct 8, 2020 | Oct 2, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Dec 29, 2020 | Oct 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-gdUpgrade php-commonUpgrade php-ldapUpgrade php-soapUpgrade php-pdoUpgrade php-odbcUpgrade php-xmlUpgrade php-fpmUpgrade phpUpgrade php-cliUpgrade php-xmlrpcUpgrade php-processUpgrade php-recode | Nov 3, 2020 | Oct 2, 2020 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.23-11.4.28.0.1.82.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.11-11.4.28.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 2, 2020 |
| Oracle_linux | — | Upgrade php-jsonUpgrade php-pecl-xdebugUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-pecl-apcu-develUpgrade php-develUpgrade php-pdoUpgrade php-soapUpgrade php-pearUpgrade php-processUpgrade php-fpmUpgrade php-pgsqlUpgrade php-gmpUpgrade php-odbcUpgrade php-commonUpgrade php-mbstringUpgrade php-cliUpgrade libzip-develUpgrade php-ffiUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-embeddedUpgrade php-dbgUpgrade php-ldapUpgrade php-gdUpgrade php-snmpUpgrade php-mysqlndUpgrade php-opcacheUpgrade phpUpgrade libzip-toolsUpgrade apcu-panelUpgrade php-xmlUpgrade php-enchantUpgrade php-dbaUpgrade php-pecl-zipUpgrade libzipUpgrade php-bcmath | Nov 17, 2021 | Jun 14, 2020 |
| Php | — | Upgrade to PHP version 7.3.23Upgrade to PHP version 7.2.34Upgrade to PHP version 7.4.11 | Oct 20, 2020 | Oct 2, 2020 |
| Redhat_linux | — | Upgrade php-mysqlnd-debuginfoUpgrade php-xmlUpgrade php-debuginfoUpgrade php-soap-debuginfoUpgrade php-odbc-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-snmp-debuginfoUpgrade php-odbcUpgrade php-commonUpgrade php-pecl-zip-debuginfoNo solution existsUpgrade php-pecl-apcu-debugsourceUpgrade php-dba-debuginfoUpgrade php-ldap-debuginfoUpgrade libzip-toolsUpgrade php-fpm-debuginfoUpgrade php-xml-debuginfoUpgrade libzip-develUpgrade libzip-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-xdebugUpgrade php-pecl-apcuUpgrade php-json-debuginfoUpgrade php-opcache-debuginfoUpgrade php-enchant-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-common-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pgsqlUpgrade php-dbgUpgrade php-pecl-xdebug-debugsourceUpgrade php-xmlrpcUpgrade php-snmpUpgrade php-pdoUpgrade php-embedded-debuginfoUpgrade apcu-panelUpgrade php-pecl-xdebug-debuginfoUpgrade php-develUpgrade php-gdUpgrade php-soapUpgrade php-dbaUpgrade php-pecl-zip-debugsourceUpgrade php-cli-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-cliUpgrade php-processUpgrade php-pecl-zipUpgrade php-intlUpgrade php-gd-debuginfoUpgrade phpUpgrade php-ffi-debuginfoUpgrade php-pecl-rrdUpgrade php-enchantUpgrade libzip-tools-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-pgsql-debuginfoUpgrade php-debugsourceUpgrade libzipUpgrade php-ldapUpgrade php-pearUpgrade php-bcmathUpgrade php-xmlrpc-debuginfoUpgrade php-mysqlndUpgrade php-embeddedUpgrade php-gmpUpgrade php-dbg-debuginfoUpgrade php-gmp-debuginfoUpgrade libzip-debugsourceUpgrade php-pecl-apcu-develUpgrade php-jsonUpgrade php-fpmUpgrade php-pdo-debuginfoUpgrade php-ffiUpgrade php-opcacheUpgrade php-process-debuginfo | Nov 10, 2021 | Oct 2, 2020 |
| Rocky_linux | — | Upgrade libzip-debuginfoUpgrade php-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebugUpgrade php-fpm-debuginfoUpgrade php-develUpgrade php-json-debuginfoUpgrade php-cli-debuginfoUpgrade php-odbcUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-dba-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-process-debuginfoUpgrade php-common-debuginfoUpgrade php-odbc-debuginfoUpgrade php-intl-debuginfoUpgrade php-mbstringUpgrade php-mbstring-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-commonUpgrade php-snmp-debuginfoUpgrade php-xml-debuginfoUpgrade php-gmpUpgrade php-ldap-debuginfoUpgrade php-pdo-debuginfoUpgrade php-opcache-debuginfoUpgrade php-jsonUpgrade php-enchant-debuginfoUpgrade php-fpmUpgrade php-pecl-rrd-debugsourceUpgrade php-embeddedUpgrade libzip-toolsUpgrade php-pdoUpgrade libzip-tools-debuginfoUpgrade libzip-debugsourceUpgrade php-mysqlndUpgrade libzipUpgrade php-debugsourceUpgrade php-enchantUpgrade php-soap-debuginfoUpgrade php-soapUpgrade php-embedded-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-snmpUpgrade php-opcacheUpgrade libzip-develUpgrade php-pecl-rrdUpgrade php-pecl-zipUpgrade php-gdUpgrade php-ffi-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-ldapUpgrade php-cliUpgrade php-dbaUpgrade php-intlUpgrade php-processUpgrade php-ffiUpgrade php-gmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-bcmathUpgrade php-pecl-apcuUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade phpUpgrade php-pgsql-debuginfoUpgrade php-xmlUpgrade php-gd-debuginfo | Mar 12, 2024 | Oct 2, 2020 |
| Suse | — | Upgrade php7-firebirdUpgrade php7-opensslUpgrade php5Upgrade php53-curlUpgrade php5-pharUpgrade php72-pcntlUpgrade php5-wddxUpgrade php7-fpmUpgrade php7-intlUpgrade php7-mbstringUpgrade php72-ctypeUpgrade php72-mysqlUpgrade php72-snmpUpgrade php74-xmlwriterUpgrade php74-calendarUpgrade php7-gettextUpgrade php53-bcmathUpgrade php72-sysvmsgUpgrade php74-intlUpgrade php53-sysvshmUpgrade php72-sysvsemUpgrade php7-opcacheUpgrade php53-odbcUpgrade php7-posixUpgrade php7-exifUpgrade php74-jsonUpgrade php74-mbstringUpgrade php7-xmlrpcUpgrade php5-pcntlUpgrade apache2-mod_php7Upgrade php5-odbcUpgrade php74-bz2Upgrade php5-xmlreaderUpgrade php53-ftpUpgrade php74-zlibUpgrade php7-domUpgrade php5-snmpUpgrade php72Upgrade php7-xmlreaderUpgrade php53-fileinfoUpgrade php53-xmlreaderUpgrade php5-fastcgiUpgrade php72-pgsqlUpgrade php7-socketsUpgrade php72-xmlrpcUpgrade php72-zlibUpgrade php53-zlibUpgrade php72-shmopUpgrade php7-gmpUpgrade php74-readlineUpgrade php7-sqliteUpgrade php72-gdUpgrade php5-ftpUpgrade php7-sysvmsgUpgrade php74-ftpUpgrade php74-pharUpgrade php7-pdoUpgrade php7-imapUpgrade php5-gettextUpgrade php53-mbstringUpgrade php5-pdoUpgrade php72-bz2Upgrade php53-snmpUpgrade php7-sodiumUpgrade php53-gdUpgrade php53-zipUpgrade php53-pdoUpgrade php7-dbaUpgrade php74-enchantUpgrade php53-fastcgiUpgrade php74-gmpUpgrade php5-jsonUpgrade php5-opensslUpgrade php7-pcntlUpgrade php7-pear-archive_tarUpgrade php72-fpmUpgrade php5-imapUpgrade php72-sysvshmUpgrade php53-pcntlUpgrade php53-mcryptUpgrade php7Upgrade php53-shmopUpgrade php53-calendarUpgrade php7-embedUpgrade php72-mbstringUpgrade php74-soapUpgrade php72-xmlreaderUpgrade php5-shmopUpgrade php74-sysvmsgUpgrade php5-zipUpgrade php74-xslUpgrade php7-xslUpgrade php72-xmlwriterUpgrade php53-gettextUpgrade php5-bcmathUpgrade php74-ctypeUpgrade php7-gdUpgrade php74-opensslUpgrade php72-curlUpgrade php74-posixUpgrade php5-calendarUpgrade php53Upgrade php5-xmlwriterUpgrade php53-pearUpgrade php74-bcmathUpgrade php5-bz2Upgrade php53-ctypeUpgrade php5-sysvsemUpgrade php5-mysqlUpgrade php7-bz2Upgrade php74-gettextUpgrade php74-exifUpgrade php72-bcmathUpgrade php74-zipUpgrade php5-pearUpgrade php74-socketsUpgrade php72-posixUpgrade php72-zipUpgrade php74-tokenizerUpgrade php5-gmpUpgrade php5-mcryptUpgrade php7-soapUpgrade php74-xmlreaderUpgrade php53-suhosinUpgrade php53-xmlwriterUpgrade php53-dbaUpgrade php7-pgsqlUpgrade php74-pgsqlUpgrade php7-tidyUpgrade php72-fileinfoUpgrade php72-exifUpgrade php72-readlineUpgrade php74-sysvsemUpgrade php53-iconvUpgrade php72-sodiumUpgrade php74-xmlrpcUpgrade php5-soapUpgrade php72-pdoUpgrade php53-pgsqlUpgrade php74-sodiumUpgrade php72-pharUpgrade php7-ldapUpgrade php72-pspellUpgrade php5-curlUpgrade php7-pearUpgrade php53-bz2Upgrade php7-curlUpgrade php72-pearUpgrade php7-mysqlUpgrade php72-opensslUpgrade php7-xmlwriterUpgrade php53-sysvsemUpgrade php74-sqliteUpgrade php7-pspellUpgrade php7-zipUpgrade php7-odbcUpgrade php74-sysvshmUpgrade php72-soapUpgrade php5-gdUpgrade php74-fileinfoUpgrade php72-wddxUpgrade php74-fastcgiUpgrade php7-readlineUpgrade php5-xmlrpcUpgrade php53-mysqlUpgrade php72-xslUpgrade apache2-mod_php53Upgrade php7-calendarUpgrade php72-iconvUpgrade php53-opensslUpgrade php5-suhosinUpgrade php5-intlUpgrade apache2-mod_php72Upgrade php5-ctypeUpgrade php72-sqliteUpgrade php7-enchantUpgrade php53-jsonUpgrade php53-domUpgrade php5-zlibUpgrade php72-jsonUpgrade php72-develUpgrade php7-jsonUpgrade php53-wddxUpgrade php7-develUpgrade php5-opcacheUpgrade php74-shmopUpgrade php5-pspellUpgrade php74-fpmUpgrade php7-tokenizerUpgrade php74-gdUpgrade php72-tidyUpgrade php72-intlUpgrade php74-pdoUpgrade php53-tokenizerUpgrade php74-odbcUpgrade php53-intlUpgrade php74Upgrade php74-curlUpgrade php5-sqliteUpgrade php5-ldapUpgrade php5-sysvmsgUpgrade php74-snmpUpgrade php74-domUpgrade php72-calendarUpgrade php7-ftpUpgrade php5-fpmUpgrade php72-fastcgiUpgrade php72-pear-archive_tarUpgrade php7-iconvUpgrade php7-pharUpgrade php74-dbaUpgrade php74-tidyUpgrade php72-tokenizerUpgrade php72-imapUpgrade php5-exifUpgrade php5-sysvshmUpgrade php53-exifUpgrade php72-ldapUpgrade php74-iconvUpgrade php74-opcacheUpgrade php7-testUpgrade php5-mbstringUpgrade php74-pcntlUpgrade php5-socketsUpgrade php74-mysqlUpgrade php72-enchantUpgrade php53-pspellUpgrade apache2-mod_php5Upgrade php5-domUpgrade php7-fileinfoUpgrade php72-domUpgrade php7-zlibUpgrade php72-ftpUpgrade php5-xslUpgrade php72-opcacheUpgrade php7-mcryptUpgrade php5-enchantUpgrade php5-fileinfoUpgrade php53-gmpUpgrade php5-iconvUpgrade php72-dbaUpgrade php7-ctypeUpgrade php7-fastcgiUpgrade php53-xslUpgrade php5-tokenizerUpgrade php53-sysvmsgUpgrade php53-soapUpgrade php5-dbaUpgrade php7-bcmathUpgrade php53-ldapUpgrade php5-pgsqlUpgrade php7-sysvsemUpgrade php74-ldapUpgrade php72-socketsUpgrade php72-odbcUpgrade php53-xmlrpcUpgrade php72-gmpUpgrade php7-shmopUpgrade php74-develUpgrade php7-snmpUpgrade php72-gettextUpgrade php7-wddxUpgrade php5-posixUpgrade php7-sysvshmUpgrade apache2-mod_php74 | Feb 7, 2021 | Oct 2, 2020 |
| Ubuntu | — | Upgrade php5-cliUpgrade php7.2-cliUpgrade php7.0-cgiUpgrade php7.4-fpmUpgrade libapache2-mod-php7.4Upgrade php7.4-cliUpgrade php7.2-fpmUpgrade php7.0-curlUpgrade php5-cli (Ubuntu Pro)Upgrade php7.4-curlUpgrade php7.0-fpmUpgrade libapache2-mod-php5Upgrade php5-cgiUpgrade php5-cgi (Ubuntu Pro)Upgrade php7.2-curlUpgrade libapache2-mod-php7.2Upgrade php7.4-cgiUpgrade php5-curlUpgrade libapache2-mod-php7.0Upgrade php5-curl (Ubuntu Pro)Upgrade php7.2-cgiUpgrade php7.0-cliUpgrade php5-fpmUpgrade php5-fpm (Ubuntu Pro)Upgrade libapache2-mod-php5 (Ubuntu Pro) | Mar 9, 2021 | Oct 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub