Vulnerability Name:

CVE-2021-21702 (CCN-196898)

Assigned:2021-01-26
Published:2021-01-26
Updated:2021-12-10
Summary:In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
7.5 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
6.7 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-476
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-21702

Source: CCN
Type: PHP Sec Bug #80672
Null Dereference in SoapClient

Source: CONFIRM
Type: Issue Tracking, Vendor Advisory
N/A

Source: XF
Type: UNKNOWN
php-cve202121702-dos(196898)

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20210715 [SECURITY] [DLA 2708-1] php7.0 security update

Source: GENTOO
Type: Third Party Advisory
GLSA-202105-23

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20210312-0005/

Source: DEBIAN
Type: Third Party Advisory
DSA-4856

Source: CCN
Type: Oracle CPUOct2021
Oracle Critical Patch Update Advisory - October 2021

Source: MISC
Type: Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Source: CCN
Type: PHP Web site
PHP

Source: CONFIRM
Type: Third Party Advisory
https://www.tenable.com/security/tns-2021-14

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 7.3.0 and < 7.3.27)
  • OR cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 7.4.0 and < 7.4.15)
  • OR cpe:/a:php:php:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 8.0.2)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* (Version >= 8.0.0 and <= 8.5.0)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:8.0.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:7.3.26:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:7.4.14:-:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:7458
    P
    		c-ares-devel-1.19.0-150000.3.20.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:8075
    P
    		apache2-mod_php7-7.4.33-150400.4.22.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:8172
    P
    		Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets (Important) (in QA)
    2023-05-18
    oval:org.opensuse.security:def:639
    P
    		Security update for grafana (Important) (in QA)
    2022-10-06
    oval:org.opensuse.security:def:93156
    P
    		 (Important)
    2022-07-13
    oval:org.opensuse.security:def:93309
    P
    		 (Moderate)
    2022-07-06
    oval:org.opensuse.security:def:3434
    P
    		apache2-mod_perl-2.0.8-11.43 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95064
    P
    		apache2-mod_php7-7.4.25-150400.2.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:99201
    P
    		 (Moderate)
    2022-01-21
    oval:org.opensuse.security:def:113133
    P
    		php7-7.4.24-2.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:5940
    P
    		Security update for libqt4 (Important)
    2021-12-22
    oval:com.redhat.rhsa:def:20214213
    P
    		RHSA-2021:4213: php:7.4 security, bug fix, and enhancement update (Moderate)
    2021-11-09
    oval:org.opensuse.security:def:102212
    P
    		Security update for rabbitmq-server (Moderate)
    2021-10-09
    oval:org.opensuse.security:def:102201
    P
    		Security update for qemu (Moderate)
    2021-08-27
    oval:org.opensuse.security:def:63507
    P
    		php7-embed-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:101415
    P
    		apache2-mod_php7-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2418
    P
    		php7-embed-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63414
    P
    		apache2-mod_php7-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2325
    P
    		apache2-mod_php7-7.4.6-3.17.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:99396
    P
    		 (Important)
    2021-07-15
    oval:org.opensuse.security:def:40758
    P
    		Security update for php53 (Important)
    2021-03-17
    oval:org.opensuse.security:def:41701
    P
    		Security update for php53 (Important)
    2021-03-17
    oval:org.opensuse.security:def:38292
    P
    		Security update for php53 (Important)
    2021-03-17
    oval:org.opensuse.security:def:45188
    P
    		Security update for php53 (Important)
    2021-03-17
    oval:org.opensuse.security:def:46131
    P
    		Security update for php53 (Important)
    2021-03-17
    oval:org.opensuse.security:def:92844
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69985
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:76108
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99595
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9090
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92251
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:10205
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99006
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:93003
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:70345
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:97235
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:99794
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9451
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:95499
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92446
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69591
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:10396
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:8704
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:70536
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:67040
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:100106
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9646
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:5951
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92645
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:69786
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:108878
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:8895
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:92056
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:9845
    P
    		Security update for php7 (Important)
    2021-02-24
    oval:org.opensuse.security:def:20989
    P
    		Security update for php74 (Important)
    2021-02-19
    oval:org.opensuse.security:def:5182
    P
    		Security update for php74 (Important)
    2021-02-19
    oval:org.opensuse.security:def:49460
    P
    		Security update for php74 (Important)
    2021-02-19
    oval:org.opensuse.security:def:26195
    P
    		Security update for php74 (Important)
    2021-02-19
    oval:org.opensuse.security:def:43799
    P
    		Security update for php5 (Important)
    2021-02-18
    oval:org.opensuse.security:def:39369
    P
    		Security update for php5 (Important)
    2021-02-18
    oval:org.opensuse.security:def:111227
    P
    		Security update for php7 (Important)
    2021-02-18
    oval:org.opensuse.security:def:118589
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:109262
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:97221
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:95488
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:69261
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:5179
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:49459
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:26192
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:109493
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:67029
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:108867
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:102596
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:95883
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:20988
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:118347
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:102827
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:76097
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:68547
    P
    		Security update for php7 (Important)
    2021-02-17
    oval:org.opensuse.security:def:96137
    P
    		Security update for php7 (Important)
    2021-02-17
    BACK
    php php *
    php php *
    php php *
    debian debian linux 9.0
    debian debian linux 10.0
    netapp clustered data ontap -
    oracle communications diameter signaling router *
    php php 8.0.1 -
    php php 7.3.26 -
    php php 7.4.14 -