CVE-2020-7066

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-7066
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7066.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-7066
Aliases
Downstream
Related
Published
2020-04-01T04:15:14Z
Modified
2026-07-07T08:51:39Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "fixed": "5.19.0"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "tenable:tenable.sc"
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "15.1"
                },
                {
                    "last_affected": "15.1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "opensuse:leap"
        },
        {
            "cpes": [
                "cpe:2.3:a:tenable:tenable.sc:5.19.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "5.19.0"
                },
                {
                    "last_affected": "5.19.0"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "tenable:tenable.sc"
        }
    ]
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
8148cbb78841c8ec0759c0836e7f35dec799d300
Fixed
cc274342d26942fc162aff6203e23372b5715d80
Introduced
52ace952a1b65ca80fc2617f11c2fa6dd03f51bd
Fixed
4e330d3d488c232ad5f9769f1fa9471c9b5ad088
Introduced
3c7824e16ec4c3cee417262445d2c2b66531c10f
Fixed
acfdeccb2ee5821138a8d68b12177daff1e63e41
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.2.0"
        },
        {
            "fixed": "7.2.29"
        },
        {
            "introduced": "7.3.0"
        },
        {
            "fixed": "7.3.16"
        },
        {
            "introduced": "7.4.0"
        },
        {
            "fixed": "7.4.4"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7066.json"