PHP Package Vulnerability: CVE-2020-7066 - Header Truncation Risk
Summary
UBUNTU-CVE-2020-7066: In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm11. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PHP package is a widely-used server-side scripting language designed for web development. It allows developers to create dynamic web pages and applications. PHP is known for its flexibility, ease of use, and extensive community support. However, certain versions of PHP have been found to be vulnerable to a specific issue where user-supplied URLs containing a zero (\0) character can lead to unintended behavior in the get_headers() function, potentially exposing sensitive information.
Vulnerability Detail
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16, and 7.4.x below 7.4.4, the get_headers() function can truncate URLs at a zero (\0) character. This vulnerability can lead to incorrect assumptions about the target URL, causing software to send information to unintended servers. The issue arises from improper handling of user-supplied input, which can be exploited by attackers to manipulate server behavior.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the get_headers() function with user-supplied URLs that may contain zero (\0) characters. Validate and sanitize all user inputs to prevent potential exploitation.
Conclusion
CVE-2020-7066 represents a significant risk for applications using vulnerable versions of PHP. It is crucial to update to the latest patched versions to mitigate the risk of exploitation. Additionally, validating and sanitizing user inputs can help prevent potential attacks.
See every vulnerability recorded for php5 →
FAQ
CVE-2020-7066 is a vulnerability in certain versions of PHP that allows for URL truncation when using the get_headers() function with user-supplied input.
PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16, and 7.4.x below 7.4.4 are affected by this vulnerability.
The vulnerability can lead to incorrect assumptions about the target URL, potentially causing sensitive information to be sent to unintended servers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 4.3, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
