PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 4 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.
Why it matters now
EPSS 0.05029 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial PHP (PHP Group): 7.3.23, 7.4.11, 7.2.34Red Hat: 2 advisoriesRed Hat: 4 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PHP Group | PHP | 7.3.x to before 7.3.23; 7.4.x to before 7.4.11; 7.2.x to before 7.2.34 | 7.3.23, 7.4.11, 7.2.34 | Patch available | CNA |
- PHP VendorPHP Group Affected 7.3.x to before 7.3.23; 7.4.x to before 7.4.11; 7.2.x to before 7.2.34 Fixed in 7.3.23, 7.4.11, 7.2.34 Patch available CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:php:php:*:*:*:*:*:*:*:* | 7.2.0 to before 7.2.34; 7.3.0 to before 7.3.23; 7.4.0 to before 7.4.11 | Vulnerable | PHP |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.2.0 to before 7.2.34; 7.3.0 to before 7.3.23; 7.4.0 to before 7.4.11 Vulnerable ·PHP
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* | 20.04 | Vulnerable | Canonical |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | before 5.19.0 | Vulnerable | Tenable |
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.19.0 Vulnerable ·Tenable
Remediation
- Fix · CNA PHP (PHP Group) Fixed in 7.3.23, 7.4.11, 7.2.34
Red Hat 2 advisories
- RHSA-2021:4213 Released 2021-11-09 · Red Hat rating Moderatephp:7.4 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) apcu-panel-5.1.18-1.module+el8.3.0+6678+b09f589e.noarch::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.aarch64::php:7.4, libzip-1.6.1-1.module+el8.3.0+6678+b09f589e.ppc64le::php:7.4 +47
- RHSA-2021:2992 Released 2021-08-03 · Red Hat rating Moderaterh-php73-php security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-php73-php-7.3.29-1.el7, rh-php73-php-bcmath-7.3.29-1.el7, rh-php73-php-cli-7.3.29-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-php73-php-7.3.29-1.el7, rh-php73-php-bcmath-7.3.29-1.el7, rh-php73-php-cli-7.3.29-1.el7 +26
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-php73-php-7.3.29-1.el7, rh-php73-php-bcmath-7.3.29-1.el7, rh-php73-php-cli-7.3.29-1.el7 +26
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
PHP — openSUSE-SU-2020:1703
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
- Advisory ·
PHP — openSUSE-SU-2020:1767
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
Show 5 more groups
- Advisory ·
PHP — FEDORA-2020-4fe6b116e5
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
- Advisory ·
PHP — FEDORA-2020-94763cb98b
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
- Advisory ·
PHP — FEDORA-2020-4573f0e03a
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
- Advisory ·
PHP — GLSA-202012-16
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
- Advisory ·
PHP — USN-4583-1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-05708 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPriority LOW 33
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Software Collections | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4213 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:2992 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:2992 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:2992 |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7070
- 2026-10-03 Alias added: GHSA-j7r5-hm2w-qqf9
References
Exploit 1
Advisory 14
- https://bugs.php.net/bug.php?id=79699
- http://cve.circl.lu/cve/CVE-2020-8184
- FEDORA-2020-4573f0e03a
- [debian-lts-announce] 20201006 [SECURITY] [DLA 2397-1] php7.0 security update
- FEDORA-2020-4fe6b116e5
- FEDORA-2020-94763cb98b
- openSUSE-SU-2020:1703
- USN-4583-1
- openSUSE-SU-2020:1767
- GLSA-202012-16
- DSA-4856
- https://security.netapp.com/advisory/ntap-20201016-0001/
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.tenable.com/security/tns-2021-14
More PHP Group vulnerabilities
- TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
- TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
- TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
- TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
- TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
- TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
Sources
- CVE-2020-7070 · CVE Program
- CVE-2020-7070 · NVD
- FIRST EPSS
- GHSA-j7r5-hm2w-qqf9 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7070 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences