CVE-2021-21707

NameCVE-2021-21707
DescriptionIn PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3243-1, DSA-5082-1, ELA-775-1, ELA-777-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php5 (PTS)jessie, jessie (lts)5.6.40+dfsg-0+deb8u21fixed
php7.0 (PTS)stretch (security)7.0.33-0+deb9u12vulnerable
stretch (lts), stretch7.0.33-0+deb9u19fixed
php7.3 (PTS)buster, buster (lts)7.3.31-1~deb10u8fixed
buster (security)7.3.31-1~deb10u7fixed
php7.4 (PTS)bullseye7.4.33-1+deb11u5fixed
bullseye (security)7.4.33-1+deb11u6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php5sourcejessie5.6.40+dfsg-0+deb8u16ELA-777-1
php5source(unstable)(unfixed)
php7.0sourcestretch7.0.33-0+deb9u13ELA-775-1
php7.0source(unstable)(unfixed)
php7.3sourcebuster7.3.31-1~deb10u2DLA-3243-1
php7.3source(unstable)(unfixed)
php7.4sourcebullseye7.4.28-1+deb11u1DSA-5082-1
php7.4source(unstable)7.4.26-1
php8.0source(unstable)(unfixed)
php8.1source(unstable)8.1.0-1

Notes

[stretch] - php7.0 <no-dsa> (Minor issue, fix along with next DLA)
Fixed in 8.1.0, 8.0.13, 7.4.26, 7.3.33
PHP Bug: https://bugs.php.net/79971
https://github.com/php/php-src/commit/f15f8fc573eb38c3c73e23e0930063a6f6409ed4

Search for package or bug name: Reporting problems