CVE-2020-7070: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
Fixed bug (PHP parses encoded cookie names so malicious Host- cookies can be sent). (CVE-2020-7070)
Other sources
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-7070.
What is the title of the vulnerability?
The title of the vulnerability is 'Fixed bug (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent).
What is the severity of CVE-2020-7070?
The severity of CVE-2020-7070 is medium with a severity value of 5.3.
Which versions of PHP are affected by CVE-2020-7070?
PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11 are affected by CVE-2020-7070.
How can I fix CVE-2020-7070?
To fix CVE-2020-7070, update PHP to version 7.2.34, 7.3.23, or 7.4.11.