In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-pgsqlUpgrade php-pecl-rrdUpgrade php-xmlUpgrade php-snmpUpgrade php-ffiUpgrade php-mbstringUpgrade libzip-develUpgrade php-xmlrpcUpgrade libzip-toolsUpgrade php-pearUpgrade php-commonUpgrade php-odbcUpgrade php-dbaUpgrade php-cliUpgrade php-processUpgrade php-pecl-zipUpgrade phpUpgrade php-pecl-apcu-develUpgrade php-dbgUpgrade php-fpmUpgrade libzipUpgrade php-enchantUpgrade php-mysqlndUpgrade php-opcacheUpgrade php-pdoUpgrade php-pecl-xdebugUpgrade php-soapUpgrade apcu-panelUpgrade php-embeddedUpgrade php-develUpgrade php-bcmathUpgrade php-intlUpgrade php-pecl-apcuUpgrade php-gmpUpgrade php-ldapUpgrade php-gdUpgrade php-json | May 13, 2022 | Oct 2, 2020 |
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Oct 2, 2020 |
| Amazon_linux | — | Upgrade php73Upgrade php72 | Jul 17, 2021 | Oct 2, 2020 |
| Centos_linux | — | Upgrade php-bcmathUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-jsonUpgrade libzip-tools-debuginfoUpgrade php-debugsourceUpgrade php-enchantUpgrade php-pecl-apcuUpgrade phpUpgrade libzip-debugsourceUpgrade php-embeddedUpgrade php-fpm-debuginfoUpgrade php-embedded-debuginfoUpgrade php-enchant-debuginfoUpgrade php-pecl-zipUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pdoUpgrade php-gmp-debuginfoUpgrade php-ffiUpgrade php-gmpUpgrade apcu-panelUpgrade php-intlUpgrade php-pecl-zip-debuginfoUpgrade php-dbaUpgrade php-gd-debuginfoUpgrade php-gdUpgrade php-opcacheUpgrade php-ffi-debuginfoUpgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-pgsql-debuginfoUpgrade php-soapUpgrade libzipUpgrade php-fpmUpgrade php-ldapUpgrade php-dbgUpgrade php-mysqlndUpgrade php-pecl-apcu-develUpgrade php-develUpgrade php-snmp-debuginfoUpgrade php-dbg-debuginfoUpgrade php-pecl-xdebugUpgrade php-json-debuginfoUpgrade libzip-debuginfoUpgrade php-commonUpgrade php-pearUpgrade php-odbc-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-common-debuginfoUpgrade libzip-toolsUpgrade php-pdo-debuginfoUpgrade php-process-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-ldap-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-rrdUpgrade php-xmlrpcUpgrade php-soap-debuginfoUpgrade php-dba-debuginfoUpgrade php-odbcUpgrade php-intl-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade libzip-develUpgrade php-snmpUpgrade php-debuginfoUpgrade php-opcache-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debugsourceUpgrade php-cli-debuginfoUpgrade php-processUpgrade php-pecl-rrd-debuginfo | Nov 10, 2021 | Oct 2, 2020 |
| Debian | — | Upgrade php7.4 | Oct 8, 2020 | Oct 2, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Dec 29, 2020 | Oct 2, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-commonUpgrade php-soapUpgrade php-pdoUpgrade php-gdUpgrade php-odbcUpgrade php-ldapUpgrade php-xmlUpgrade phpUpgrade php-cliUpgrade php-recodeUpgrade php-processUpgrade php-xmlrpcUpgrade php-fpm | Nov 3, 2020 | Oct 2, 2020 |
| Oracle Solaris | — | Upgrade web/php-73 to version 7.3.23-11.4.28.0.1.82.2 on Solaris 11.4Upgrade web/php-74 to version 7.4.11-11.4.28.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 2, 2020 |
| Oracle_linux | — | Upgrade php-gdUpgrade php-ldapUpgrade php-pecl-zipUpgrade php-embeddedUpgrade php-snmpUpgrade php-mysqlndUpgrade libzipUpgrade php-intlUpgrade php-dbgUpgrade php-ffiUpgrade php-bcmathUpgrade libzip-develUpgrade php-cliUpgrade php-pecl-apcuUpgrade apcu-panelUpgrade php-dbaUpgrade php-xmlUpgrade phpUpgrade php-enchantUpgrade libzip-toolsUpgrade php-opcacheUpgrade php-pecl-xdebugUpgrade php-pearUpgrade php-commonUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-soapUpgrade php-pecl-rrdUpgrade php-jsonUpgrade php-pdoUpgrade php-develUpgrade php-pgsqlUpgrade php-gmpUpgrade php-fpmUpgrade php-processUpgrade php-odbcUpgrade php-mbstring | Nov 17, 2021 | Jun 14, 2020 |
| Php | — | Upgrade to PHP version 7.2.34Upgrade to PHP version 7.3.23Upgrade to PHP version 7.4.11 | Oct 20, 2020 | Oct 2, 2020 |
| Redhat_linux | — | Upgrade php-bcmath-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlUpgrade php-pecl-apcuUpgrade php-xmlrpcUpgrade php-pecl-zip-debuginfoUpgrade php-soap-debuginfoUpgrade php-ldap-debuginfoUpgrade php-snmpUpgrade php-pecl-xdebug-debugsourceUpgrade php-pgsqlNo solution existsUpgrade php-pecl-apcu-debugsourceUpgrade php-pecl-xdebugUpgrade libzip-debuginfoUpgrade php-mbstringUpgrade php-enchant-debuginfoUpgrade php-opcache-debuginfoUpgrade php-commonUpgrade php-json-debuginfoUpgrade php-intl-debuginfoUpgrade libzip-toolsUpgrade php-odbcUpgrade libzip-develUpgrade php-common-debuginfoUpgrade php-dba-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-debuginfoUpgrade php-dbgUpgrade php-mysqlnd-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-odbc-debuginfoUpgrade php-fpm-debuginfoUpgrade php-snmp-debuginfoUpgrade php-jsonUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-ffiUpgrade libzip-debugsourceUpgrade php-embedded-debuginfoUpgrade php-gmpUpgrade php-dbg-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-pgsql-debuginfoUpgrade phpUpgrade php-enchantUpgrade php-gd-debuginfoUpgrade php-ffi-debuginfoUpgrade php-intlUpgrade php-pecl-rrdUpgrade php-pecl-apcu-debuginfoUpgrade php-process-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-gdUpgrade php-pecl-zip-debugsourceUpgrade php-bcmathUpgrade php-pdoUpgrade libzipUpgrade php-pearUpgrade php-soapUpgrade php-debugsourceUpgrade php-embeddedUpgrade php-mysqlndUpgrade php-pdo-debuginfoUpgrade php-gmp-debuginfoUpgrade php-fpmUpgrade php-pecl-zipUpgrade php-opcacheUpgrade php-cliUpgrade apcu-panelUpgrade php-processUpgrade php-cli-debuginfoUpgrade php-develUpgrade php-dba | Nov 10, 2021 | Oct 2, 2020 |
| Rocky_linux | — | Upgrade php-pgsql-debuginfoUpgrade php-mysqlndUpgrade libzip-toolsUpgrade php-embedded-debuginfoUpgrade php-pecl-apcuUpgrade php-xmlrpc-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php-soap-debuginfoUpgrade php-pecl-xdebug-debuginfoUpgrade phpUpgrade php-processUpgrade php-bcmathUpgrade php-pecl-rrd-debugsourceUpgrade php-dbg-debuginfoUpgrade libzipUpgrade php-intlUpgrade libzip-debugsourceUpgrade php-dbaUpgrade php-gd-debuginfoUpgrade php-enchantUpgrade php-pdoUpgrade libzip-tools-debuginfoUpgrade php-ffiUpgrade php-pecl-rrdUpgrade php-soapUpgrade php-opcacheUpgrade php-snmpUpgrade libzip-develUpgrade php-embeddedUpgrade php-xmlUpgrade php-gmp-debuginfoUpgrade php-debugsourceUpgrade php-ffi-debuginfoUpgrade php-gdUpgrade php-pecl-zipUpgrade php-bcmath-debuginfoUpgrade php-cliUpgrade php-ldapUpgrade php-odbc-debuginfoUpgrade php-dbgUpgrade php-odbcUpgrade php-xml-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-xdebugUpgrade php-json-debuginfoUpgrade php-cli-debuginfoUpgrade php-intl-debuginfoUpgrade php-process-debuginfoUpgrade php-common-debuginfoUpgrade php-opcache-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-mbstring-debuginfoUpgrade php-mbstringUpgrade php-enchant-debuginfoUpgrade php-pdo-debuginfoUpgrade php-ldap-debuginfoUpgrade php-gmpUpgrade php-debuginfoUpgrade php-jsonUpgrade php-pecl-apcu-debugsourceUpgrade php-fpm-debuginfoUpgrade php-develUpgrade php-dba-debuginfoUpgrade php-pgsqlUpgrade php-pecl-zip-debuginfoUpgrade php-pecl-xdebug-debugsourceUpgrade php-commonUpgrade php-snmp-debuginfoUpgrade libzip-debuginfoUpgrade php-pecl-apcu-develUpgrade php-xmlrpcUpgrade php-fpm | Mar 12, 2024 | Oct 2, 2020 |
| Suse | — | Upgrade php7-ldapUpgrade php72-develUpgrade php72-enchantUpgrade php7-tokenizerUpgrade php74-shmopUpgrade php7-jsonUpgrade php5-socketsUpgrade apache2-mod_php5Upgrade php5-curlUpgrade php74-gdUpgrade php74-pdoUpgrade php74-curlUpgrade php72-soapUpgrade php72-opensslUpgrade php74Upgrade php74-fpmUpgrade php5-xmlrpcUpgrade apache2-mod_php53Upgrade php74-sodiumUpgrade php53-mysqlUpgrade php5-opcacheUpgrade php53-domUpgrade php74-sqliteUpgrade php72-domUpgrade php72-jsonUpgrade php7-iconvUpgrade php5-ldapUpgrade php53-intlUpgrade php5-pspellUpgrade php72-pharUpgrade php7-calendarUpgrade php7-odbcUpgrade php74-tidyUpgrade php53-pgsqlUpgrade php7-readlineUpgrade php7-sysvshmUpgrade php7-wddxUpgrade php7-zipUpgrade php72-wddxUpgrade php74-fastcgiUpgrade php74-sysvshmUpgrade php5-posixUpgrade php7-shmopUpgrade php72-xslUpgrade apache2-mod_php74Upgrade php5-xslUpgrade php53-sysvsemUpgrade php5-sqliteUpgrade php74-iconvUpgrade php7-xmlwriterUpgrade php7-fileinfoUpgrade php5-zlibUpgrade php72-tidyUpgrade php53-xmlrpcUpgrade php72-ldapUpgrade php74-mysqlUpgrade php7-pspellUpgrade php53-gmpUpgrade php53-pspellUpgrade php72-pspellUpgrade php5-sysvmsgUpgrade php5-gdUpgrade php74-snmpUpgrade php7-ftpUpgrade php53-ldapUpgrade php74-odbcUpgrade php72-gmpUpgrade php7-zlibUpgrade php7-sysvsemUpgrade php74-dbaUpgrade php53-soapUpgrade php53-sysvmsgUpgrade php72-dbaUpgrade php72-opcacheUpgrade php74-develUpgrade php7-ctypeUpgrade php74-ldapUpgrade php72-calendarUpgrade php72-odbcUpgrade php7-mcryptUpgrade php5-pgsqlUpgrade php53-xslUpgrade php72-socketsUpgrade php53-wddxUpgrade php7-curlUpgrade php72-fastcgiUpgrade php7-develUpgrade php72-sqliteUpgrade php7-testUpgrade php5-ctypeUpgrade php72-ftpUpgrade php7-pharUpgrade apache2-mod_php72Upgrade php5-mbstringUpgrade php5-fpmUpgrade php7-pearUpgrade php53-opensslUpgrade php74-fileinfoUpgrade php53-tokenizerUpgrade php5-fileinfoUpgrade php7-bcmathUpgrade php72-iconvUpgrade php5-iconvUpgrade php72-intlUpgrade php5-tokenizerUpgrade php5-enchantUpgrade php72-gettextUpgrade php5-dbaUpgrade php7-snmpUpgrade php53-exifUpgrade php53-jsonUpgrade php53-bz2Upgrade php74-pcntlUpgrade php74-opcacheUpgrade php7-fastcgiUpgrade php5-exifUpgrade php5-sysvshmUpgrade php74-domUpgrade php7-enchantUpgrade php5-intlUpgrade php5-domUpgrade php74-sysvmsgUpgrade php5-suhosinUpgrade php74-xmlrpcUpgrade php7-mysqlUpgrade php72-curlUpgrade php74-sysvsemUpgrade php7-gettextUpgrade php72-imapUpgrade php72-xmlrpcUpgrade php53-pearUpgrade php7-gmpUpgrade php72-sysvsemUpgrade php72-fpmUpgrade php72-posixUpgrade php5-opensslUpgrade php72-tokenizerUpgrade php74-soapUpgrade php72-xmlwriterUpgrade php74-ctypeUpgrade php7-xmlrpcUpgrade php74-xmlreaderUpgrade php74-mbstringUpgrade php7-gdUpgrade php72-sysvshmUpgrade php74-xslUpgrade php7-firebirdUpgrade php72-pdoUpgrade php7-fpmUpgrade php53-iconvUpgrade php74-bcmathUpgrade php74-zlibUpgrade php72-pearUpgrade php53-xmlwriterUpgrade php5-wddxUpgrade php5-bz2Upgrade php5Upgrade php72-readlineUpgrade php5-pharUpgrade php74-xmlwriterUpgrade php53-curlUpgrade php72-snmpUpgrade php72-ctypeUpgrade php7-xslUpgrade php72-exifUpgrade php5-pcntlUpgrade php74-opensslUpgrade php5-odbcUpgrade apache2-mod_php7Upgrade php74-gmpUpgrade php72-sodiumUpgrade php7-tidyUpgrade php7-soapUpgrade php53-fastcgiUpgrade php7-pgsqlUpgrade php74-jsonUpgrade php74-pgsqlUpgrade php72-pear-archive_tarUpgrade php7-imapUpgrade php74-tokenizerUpgrade php5-ftpUpgrade php5-pearUpgrade php72-bcmathUpgrade php5-xmlwriterUpgrade php74-gettextUpgrade php7Upgrade php53-mcryptUpgrade php53-ftpUpgrade php72-fileinfoUpgrade php74-calendarUpgrade php5-mcryptUpgrade php74-socketsUpgrade php74-zipUpgrade php7-embedUpgrade php53-pcntlUpgrade php5-pdoUpgrade php5-snmpUpgrade php72-zipUpgrade php74-readlineUpgrade php53-ctypeUpgrade php74-bz2Upgrade php53-pdoUpgrade php74-intlUpgrade php5-calendarUpgrade php72-shmopUpgrade php53-mbstringUpgrade php53-calendarUpgrade php72-xmlreaderUpgrade php53-gettextUpgrade php72Upgrade php7-socketsUpgrade php7-dbaUpgrade php74-posixUpgrade php7-bz2Upgrade php5-bcmathUpgrade php7-sodiumUpgrade php72-sysvmsgUpgrade php5-fastcgiUpgrade php53-shmopUpgrade php53Upgrade php53-sysvshmUpgrade php5-imapUpgrade php72-mbstringUpgrade php7-pear-archive_tarUpgrade php74-ftpUpgrade php7-mbstringUpgrade php72-zlibUpgrade php7-posixUpgrade php53-zlibUpgrade php72-gdUpgrade php53-fileinfoUpgrade php53-bcmathUpgrade php53-snmpUpgrade php7-opcacheUpgrade php7-sqliteUpgrade php53-gdUpgrade php74-exifUpgrade php74-pharUpgrade php53-zipUpgrade php72-bz2Upgrade php7-pdoUpgrade php7-intlUpgrade php53-xmlreaderUpgrade php72-pcntlUpgrade php53-odbcUpgrade php5-mysqlUpgrade php72-pgsqlUpgrade php53-dbaUpgrade php5-zipUpgrade php5-shmopUpgrade php5-xmlreaderUpgrade php53-suhosinUpgrade php5-gettextUpgrade php5-gmpUpgrade php5-soapUpgrade php7-exifUpgrade php5-sysvsemUpgrade php74-enchantUpgrade php7-opensslUpgrade php7-xmlreaderUpgrade php72-mysqlUpgrade php7-domUpgrade php5-jsonUpgrade php7-sysvmsgUpgrade php7-pcntl | Feb 7, 2021 | Oct 2, 2020 |
| Ubuntu | — | Upgrade libapache2-mod-php7.2Upgrade libapache2-mod-php7.0Upgrade php5-curlUpgrade php7.4-cgiUpgrade php5-curl (Ubuntu Pro)Upgrade php7.0-cliUpgrade php7.2-cgiUpgrade php5-fpmUpgrade php7.2-curlUpgrade php5-fpm (Ubuntu Pro)Upgrade php7.2-cliUpgrade php5-cliUpgrade php7.4-fpmUpgrade php5-cli (Ubuntu Pro)Upgrade php7.4-cliUpgrade php7.0-curlUpgrade libapache2-mod-php5 (Ubuntu Pro)Upgrade libapache2-mod-php7.4Upgrade php7.4-curlUpgrade php7.2-fpmUpgrade libapache2-mod-php5Upgrade php7.0-cgiUpgrade php7.0-fpmUpgrade php5-cgiUpgrade php5-cgi (Ubuntu Pro) | Mar 9, 2021 | Oct 2, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub