CVE-2021-21705

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server.

Security Fix(es):

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.(CVE-2021-21705)

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.(CVE-2021-21704)

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

• php: Local privilege escalation via PHP-FPM (CVE-2021-21703)

• php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es):

• php: Local privilege escalation via PHP-FPM (CVE-2021-21703)
• php: SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

• CVE-2021-21704: fix integer overflow and subsequent incorrect buffer allocation
• CVE-2021-21705: fix incorrect url password validation
• CVE-2021-21703: fix incorrect shared memory management, which led to priv escalation

• SECURITY UPDATE: Process crash and information disclosure
  • debian/patches/CVE-2020-7068.patch: fix access-after-free for actual_alias pointer
  • CVE-2020-7068
• SECURITY UPDATE: logic error due to invalid input validation
  • debian/patches/CVE-2020-7071.patch: add validation fo url->user field
  • CVE-2020-7071
• SECURITY UPDATE: program crash due to null pointer dereference
  • debian/patches/CVE-2021-21702.patch: pass empty string instead for NULL pointers to soap_error1(). Check NULL pointer in attr_is_equal_ex() and node_is_equal_ex()
  • CVE-2021-21702
• SECURITY UPDATE: integer overflow and subsequent incorrect buffer allocation
  • debian/patches/CVE-2021-21704.patch: add checks that prevent the overflow, replace strcat() with more secure strlcat()
  • CVE-2021-21704
• SECURITY UPDATE: logic error due to incorrect input validation
  • debian/patches/CVE-2021-21705.patch: fix validation of url password with FILTER_VALIDATE_URL parameter,
  • CVE-2021-21705
• SECURITY UPDATE: priv escalation due to shared memory between worker processes
  • debian/patches/CVE-2021-21703.patch: change scoreboard->proc type to array of structs and use scoreboard->nprocs only in child processes
  • CVE-2021-21703

• CVE-2021-21703: fix incorrect shared memory management, which led to priv escalation
• CVE-2021-21705: fix integer overflow and subsequent incorrect buffer allocation

• CVE-2021-21705: Fix SSRF bypass in FILTER_VALIDATE_URL adding additional check ups

• CVE-2021-21705: Fix SSRF bypass in FILTER_VALIDATE_URL adding additional check ups

• CVE-2020-7071: fix URL validation with functions like filter_var($url, FILTER_VALIDATE_URL)
• CVE-2021-21705: fix URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter when an URL with invalid password field can be accepted as valid

• CVE-2020-7071: fix URL validation with functions like filter_var($url, FILTER_VALIDATE_URL)
• CVE-2021-21705: fix URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter when an URL with invalid password field can be accepted as valid
• CVE-2024-5458: fix early-out for ipv6 hostname validation, ensure full check is performed

Updated PHP packages fix security vulnerabilities:

• Fixed bug #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705)

PDO_Firebird:

• Fixed bug #76448: Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
• Fixed bug #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704)
• Fixed bug #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704)
• Fixed bug #76452: Crash while parsing blob data in firebird_fetch_blob. (CVE-2021-21704)

Updated php packages provides upstream 8.0.8 and fixes the following security vulnerabilities:

• PDO_Firebird:
  • Fix Stack buffer overflow in firebird_info_cb (CVE-2021-21704).
  • Fix SIGSEGV in firebird_handle_doer (CVE-2021-21704).
  • Fix SIGSEGV in firebird_stmt_execute (CVE-2021-21704).
  • Fix Crash while parsing blob data in firebird_fetch_blob (CVE-2021-21704)
• Fix SSRF bypass in FILTER_VALIDATE_URL (CVE-2021-21705).

For other fixes in this update, see the referenced Changelog.

This update for php7 fixes the following issues:

• CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035).
• CVE-2021-21705: Fixed SSRF bypass in FILTER_VALIDATE_URL (bsc#1188037).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for php7 fixes the following issues:

• CVE-2021-21705 [bsc#1188037]: SSRF bypass in FILTER_VALIDATE_URL

This update for php7 fixes the following issues:

• CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035).
• CVE-2021-21705: Fixed SSRF bypass in FILTER_VALIDATE_URL (bsc#1188037).

This update for php72 fixes the following issues:

• CVE-2021-21705 [bsc#1188037]: SSRF bypass in FILTER_VALIDATE_URL

This update for php74 fixes the following issues:

• CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035).
• CVE-2021-21705: Fixed SSRF bypass in FILTER_VALIDATE_URL (bsc#1188037).

This update for php7 fixes the following issues:

• CVE-2021-21704: Fixed security issues in pdo_firebase module (bsc#1188035).
• CVE-2021-21705: Fixed SSRF bypass in FILTER_VALIDATE_URL (bsc#1188037).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)

USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)