CVE-2021-21707

Updated: 2022-12-15 19:13:15.058696

Description:

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 5
CVSS Version 3.x MEDIUM 5.3

Status

OS name Project name Version Score Severity Status Errata Last updated
EL 6 PHP php 7.0 5.3 MEDIUM Released 2022-08-18 05:02:15
EL 6 PHP php 7.1 5.3 MEDIUM Released 2022-08-18 05:02:15
EL 6 PHP php 7.2 5.3 MEDIUM Released 2022-08-12 21:17:38
EL 6 PHP php 5.5 5.3 MEDIUM Released 2022-08-18 05:02:15
EL 6 PHP php 7.3 5.3 MEDIUM Ignored 2022-08-12 21:17:38
EL 6 PHP php 5.2 5.3 MEDIUM Released 2022-08-12 14:02:13
EL 6 PHP php 5.1 5.3 MEDIUM Released 2022-08-12 08:02:06
EL 6 PHP php 5.3 5.3 MEDIUM Released 2022-08-11 17:02:14
EL 6 PHP php 5.4 5.3 MEDIUM Released 2022-08-18 05:02:15
EL 6 PHP php 5.6 5.3 MEDIUM Released 2022-08-11 17:02:13
Total: 70

Statement

Will not fix: low score