Lucene search

K
cvelistPhpCVELIST:CVE-2020-7069
HistorySep 29, 2020 - 12:00 a.m.

CVE-2020-7069 Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

2020-09-2900:00:00
CWE-20
php
raw.githubusercontent.com
1

6.5 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.4%

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.