CVE-2021-21707

NameCVE-2021-21707
DescriptionIn PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5082-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php7.3 (PTS)buster, buster (security)7.3.31-1~deb10u1vulnerable
php7.4 (PTS)bullseye7.4.30-1+deb11u1fixed
bullseye (security)7.4.33-1+deb11u1fixed
php8.1 (PTS)bookworm, sid8.1.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php7.0source(unstable)(unfixed)
php7.3source(unstable)(unfixed)
php7.4sourcebullseye7.4.28-1+deb11u1DSA-5082-1
php7.4source(unstable)7.4.26-1
php8.0source(unstable)(unfixed)
php8.1source(unstable)8.1.0-1

Notes

[buster] - php7.3 <no-dsa> (Minor issue, fix along with next DSA)
[stretch] - php7.0 <no-dsa> (Minor issue, fix along with next DLA)
Fixed in 8.1.0, 8.0.13, 7.4.26, 7.3.33
PHP Bug: https://bugs.php.net/79971
https://github.com/php/php-src/commit/f15f8fc573eb38c3c73e23e0930063a6f6409ed4

Search for package or bug name: Reporting problems