CVE-2020-7068 : Security Advisory and Response

PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9 are affected by a vulnerability in the phar_parse_zipfile function that could lead to a crash or information disclosure.

Understanding CVE-2020-7068

This CVE involves the use of a freed hash key in the phar_parse_zipfile function in PHP.

What is CVE-2020-7068?

In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21, and 7.4.x below 7.4.9, a vulnerability exists in the phar_parse_zipfile function that could allow attackers to access freed memory, potentially resulting in a crash or disclosure of sensitive information.

The Impact of CVE-2020-7068

The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 4.8. The attack complexity is considered HIGH, with a NETWORK attack vector and LOW availability impact.

Technical Details of CVE-2020-7068

This section provides more technical insights into the vulnerability.

Vulnerability Description

The issue arises when processing PHAR files using the phar extension, where phar_parse_zipfile can be manipulated to access freed memory.

Affected Systems and Versions

PHP 7.2.x versions below 7.2.33
PHP 7.3.x versions below 7.3.21
PHP 7.4.x versions below 7.4.9

Exploitation Mechanism

Attackers can exploit this vulnerability by tricking the phar_parse_zipfile function into accessing freed memory, leading to potential crashes or information disclosure.

Mitigation and Prevention

Protecting systems from CVE-2020-7068 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update PHP to versions 7.2.33, 7.3.21, or 7.4.9 to mitigate the vulnerability.
Disable the phar extension if not required for essential functionality.

Long-Term Security Practices

Regularly monitor security advisories and update PHP promptly.
Implement secure coding practices to prevent memory-related vulnerabilities.

Patching and Updates

Apply patches provided by PHP Group to address the vulnerability and enhance system security.