CVE-2020-7066

Katalog CVE

CVSS 4.3 · Medium EPSS 2,8%

Kerentanan Improper Null Termination pada php, tenable.sc +2 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Rincian

Terbit di NVD

1 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-170: Improper Null Termination

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 85,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.php.net/bug.php?id=79329 exploit · issue tracking · patch · advisory vendor
• https://www.tenable.com/security/tns-2021-14 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00025.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/04/msg00021.html advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200403-0001/ advisory pihak ketiga
• https://usn.ubuntu.com/4330-2/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4717 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4719 advisory pihak ketiga