CVE-2020-7070

描述

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

如何修補 CVE-2020-7070

要修補 CVE-2020-7070,請將受影響套件升級到下列已修補版本。

• —升級至 7.2.34 或更新版本
• —升級至 7.2.34 或更新版本
• —升級至 7.2.34 或更新版本
• —升級至 7.0.33-0+deb9u10 或更新版本
• —升級至 7.4.11-1 或更新版本

CVE-2020-7070 正在被利用嗎?

中等 — EPSS 為 5.0%,可持續追蹤但非最高優先。

受影響套件(5)

• >= 7.2.0, < 7.2.34, >= 7.3.0, < 7.3.23, >= 7.4.0, < 7.4.11
• >= 7.2.0, < 7.2.34, >= 7.3.0, < 7.3.23, >= 7.4.0, < 7.4.11
• >= 7.2.0, < 7.2.34, >= 7.3.0, < 7.3.23, >= 7.4.0, < 7.4.11
• from 0, < 7.0.33-0+deb9u10
• from 0, < 7.4.11-1

CVSS 分數

參考連結(17)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-7070
• WEBcve.circl.lu/cve/CVE-2020-8184
• WEBlists.opensuse.org/opensuse-security-announce/2020-10/msg00045.html
• WEBlists.opensuse.org/opensuse-security-announce/2020-10/msg00067.html