CVE-2020-7066: get_headers() silently truncates after a null byte
A vulnerability was found in PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using getheaders() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheaders() and possibly send some information to a wrong server.
Other sources
Fixed bug (getheaders() silently truncates after a null byte) (CVE-2020-7066) (cmb)
— PHP
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using getheaders() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheaders() and possibly send some information to a wrong server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-php73-phpto a version that resolves this vulnerability.Fixed in 0:7.3.20-1.el7 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.2.29 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.3.16 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.4.4 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.2.29 - Upgrade
Upgrade
debian/php7.4to a version that resolves this vulnerability.Fixed in 7.4.33-1+deb11u5Fixed in 7.4.33-1+deb11u11 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.2.29 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.3.16 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.4 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.2.9 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.4.34 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2020-7066
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7066?
CVE-2020-7066 is a vulnerability in PHP versions 7.2.x, 7.3.x, and 7.4.x that allows an attacker to truncate URLs containing null bytes when using the get_headers() function.
How severe is CVE-2020-7066?
CVE-2020-7066 has a severity rating of 4.3 (medium).
How does CVE-2020-7066 affect PHP versions?
CVE-2020-7066 affects PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16, and 7.4.x below 7.4.4.
What is the impact of CVE-2020-7066?
The impact of CVE-2020-7066 is that certain software may make incorrect assumptions about the target of the get_headers() function when the URL is truncated.
How can I fix CVE-2020-7066?
To fix CVE-2020-7066, you should update PHP to version 7.2.29, 7.3.16, or 7.4.4 depending on the version you are currently using.