CVE-2020-7069: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days.

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only; version 33 only
• Netapp Clustered Data Ontap: affected versions not specified
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle Communications Diameter Signaling Router: from 8.0.0, up to and including 8.5.0
• PHP PHP: from 7.2.0, before 7.2.34 (fixed in 7.2.34); from 7.3.0, before 7.3.23 (fixed in 7.3.23); from 7.4.0, before 7.4.11 (fixed in 7.4.11)
• Tenable Tenable.sc: before 5.19.0 (fixed in 5.19.0)

Published 2020-10-02. Last modified 2026-06-17.