In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php | Php | 7.2.0 (including) | 7.2.34 (excluding) |
| Php | Php | 7.3.0 (including) | 7.3.23 (excluding) |
| Php | Php | 7.4.0 (including) | 7.4.11 (excluding) |
| Red Hat Enterprise Linux 8 | RedHat | php:7.4-8050020210526053050.3e6e7e84 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-php73-php-0:7.3.29-1.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-php73-php-0:7.3.29-1.el7 | * |
| Php5 | Ubuntu | trusty | * |
| Php5 | Ubuntu | trusty/esm | * |
| Php7.2 | Ubuntu | bionic | * |
| Php7.4 | Ubuntu | devel | * |
| Php7.4 | Ubuntu | focal | * |
| Php7.4 | Ubuntu | groovy | * |