Описание
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| esm-infra-legacy/trusty | not-affected | 5.5.9+dfsg-1ubuntu4.29+esm13 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| groovy | DNE | |
| precise/esm | not-affected | 5.3.10-1ubuntu3.48 |
| trusty | ignored | end of standard support |
| trusty/esm | released | 5.5.9+dfsg-1ubuntu4.29+esm13 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/focal | DNE | |
| esm-infra/xenial | not-affected | |
| focal | DNE | |
| groovy | DNE | |
| precise/esm | DNE | |
| trusty | DNE | |
| trusty/esm | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 7.2.24-0ubuntu0.18.04.7 |
| devel | DNE | |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/bionic | not-affected | 7.2.24-0ubuntu0.18.04.7 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| groovy | DNE | |
| precise/esm | DNE | |
| trusty | DNE | |
| trusty/esm | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | released | 7.4.9-1ubuntu1.1 |
| esm-infra-legacy/trusty | DNE | |
| esm-infra/focal | not-affected | 7.4.3-4ubuntu2.4 |
| focal | released | 7.4.3-4ubuntu2.4 |
| groovy | released | 7.4.9-1ubuntu1.1 |
| precise/esm | DNE | |
| trusty | DNE | |
| trusty/esm | DNE | |
| upstream | needs-triage |
Показывать по
EPSS
6.4 Medium
CVSS2
5.4 Medium
CVSS3
Связанные уязвимости
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below ...
In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
Уязвимость функции openssl_encrypt() языка программирования php, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность
EPSS
6.4 Medium
CVSS2
5.4 Medium
CVSS3