Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-7069

18
FAUCET Score

CVE-2020-7069 is a medium-severity vulnerability affecting PHP versions 7.2.x, 7.3.x, and 7.4.x, specifically when using the openssl_encrypt() function with AES-CCM mode and a 12-byte IV. The flaw causes only the first 7 bytes of the IV to be utilized, leading to decreased security and potentially incorrect encryption. This vulnerability impacts various distributions and products including Canonical, Debian, Fedora, NetApp, openSUSE, Oracle, and Tenable. The vulnerability has a CVSS score of 6.5 (Medium), indicating it can be exploited remotely with low attack complexity and no user interaction, potentially leading to partial confidentiality and integrity compromise. The EPSS score is low, suggesting a low probability of exploitation. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical low attention for the majority of CVEs.

Impacted Technologies

VendorProductVersion(s)CPE
>= 7.2.0, < 7.2.34CPE matchmatch criteria
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
>= 7.3.0, < 7.3.23CPE matchmatch criteria
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
>= 7.4.0, < 7.4.11CPE matchmatch criteria
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
31CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
32CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.4MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
2.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.05%
Probability of exploitation in next 30 days
EPSS Percentile
79.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0205 is in the 68th percentile among its peer group of 23,723 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: php:7.4-8050020210526053050.3e6e7e84
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-php73-php-0:7.3.29-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-php73-php-0:7.3.29-1.el7
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: php:7.2/php
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: php:7.3/php

Vendor Advisories (1)

redhatCVE-2020-7069Moderate

php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV

May 15, 2020

References

lists.opensuse.org / opensuse-security-announce/2020-10/msg00045.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-security-announce/2020-10/msg00067.html
Mailing ListThird Party Advisory
bugs.php.net / bug.php
Issue TrackingPatchVendor Advisory
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/7EVDN7D3IB4EAI4D3ZOM2OJKQ5SD7K4E
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/P2J3ZZDHCSX65T5QWV4AHBN7MOJXBEKG
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/RRU57N3OSYZPOMFWPRDNVH7EMYOTSZ66
security.gentoo.org / glsa/202012-16
Third Party Advisory
security.netapp.com / advisory/ntap-20201016-0001
Third Party Advisory
usn.ubuntu.com / 4583-1
Third Party Advisory
debian.org / security/2021/dsa-4856
Third Party Advisory
oracle.com / security-alerts/cpuApr2021.html
PatchThird Party Advisory
oracle.com / security-alerts/cpuoct2021.html
PatchThird Party Advisory
tenable.com / security/tns-2021-14
Third Party Advisory