CVE-2020-7066

In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Weakness

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

Affected Software

Name	Vendor	Start Version	End Version
Php	Php	7.2.0 (including)	7.2.29 (excluding)
Php	Php	7.3.0 (including)	7.3.16 (excluding)
Php	Php	7.4.0 (including)	7.4.4 (excluding)
Red Hat Enterprise Linux 8	RedHat	php:7.3-8020020200715124551.ceb1cf90	*
Red Hat Software Collections for Red Hat Enterprise Linux 7	RedHat	rh-php73-php-0:7.3.20-1.el7	*
Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS	RedHat	rh-php73-php-0:7.3.20-1.el7	*
Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS	RedHat	rh-php73-php-0:7.3.20-1.el7	*
Php5	Ubuntu	esm-infra-legacy/trusty	*
Php5	Ubuntu	precise/esm	*
Php5	Ubuntu	trusty	*
Php5	Ubuntu	trusty/esm	*
Php7.0	Ubuntu	esm-infra/xenial	*
Php7.0	Ubuntu	xenial	*
Php7.2	Ubuntu	bionic	*
Php7.2	Ubuntu	esm-infra/bionic	*
Php7.3	Ubuntu	eoan	*
Php7.4	Ubuntu	devel	*
Php7.4	Ubuntu	esm-infra/focal	*
Php7.4	Ubuntu	focal	*
Php7.4	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-7066
CWE	https://cwe.mitre.org/data/definitions/170.html

Improper Null Termination

Weakness

Affected Software

Potential Mitigations

References