CVE-2020-7069: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
Fixed bug (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
Other sources
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with opensslencrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-7069.
What is the title of the vulnerability?
The title of the vulnerability is Fixed bug (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV).
What is the severity of CVE-2020-7069?
The severity of CVE-2020-7069 is medium, with a CVSS score of 6.5.
Which versions of PHP are affected by CVE-2020-7069?
PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11 are affected by CVE-2020-7069.
How can I fix the CVE-2020-7069 vulnerability?
To fix the CVE-2020-7069 vulnerability, update PHP to version 7.2.34, 7.3.23, or 7.4.11 depending on your PHP version.