CVE-2021-21702

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110)

Security Fix(es):

• php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

• php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

• php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

• php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server (CVE-2020-7070)

• php: NULL pointer dereference in SoapClient (CVE-2021-21702)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.4.19). (BZ#1944110)

Security Fix(es):

• php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)

• php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo (CVE-2020-7071)

• php: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)

• php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server (CVE-2020-7070)

• php: NULL pointer dereference in SoapClient (CVE-2021-21702)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

• SECURITY UPDATE: Process crash and information disclosure
  • debian/patches/CVE-2020-7068.patch: fix access-after-free for actual_alias pointer
  • CVE-2020-7068
• SECURITY UPDATE: logic error due to invalid input validation
  • debian/patches/CVE-2020-7071.patch: add validation fo url->user field
  • CVE-2020-7071
• SECURITY UPDATE: program crash due to null pointer dereference
  • debian/patches/CVE-2021-21702.patch: pass empty string instead for NULL pointers to soap_error1(). Check NULL pointer in attr_is_equal_ex() and node_is_equal_ex()
  • CVE-2021-21702
• SECURITY UPDATE: integer overflow and subsequent incorrect buffer allocation
  • debian/patches/CVE-2021-21704.patch: add checks that prevent the overflow, replace strcat() with more secure strlcat()
  • CVE-2021-21704
• SECURITY UPDATE: logic error due to incorrect input validation
  • debian/patches/CVE-2021-21705.patch: fix validation of url password with FILTER_VALIDATE_URL parameter,
  • CVE-2021-21705
• SECURITY UPDATE: priv escalation due to shared memory between worker processes
  • debian/patches/CVE-2021-21703.patch: change scoreboard->proc type to array of structs and use scoreboard->nprocs only in child processes
  • CVE-2021-21703

• CVE-2020-7068: php: Use of freed hash key in the phar_parse_zipfile function
• CVE-2020-7069: php: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
• CVE-2020-7070: php: URL decoding of cookie names can lead to different interpretation of cookies between browser and server
• CVE-2020-7071: php: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
• CVE-2021-21702: php: NULL pointer dereference in SoapClient

• CVE-2021-21702: fix null pointer dereference in Soap Client

• CVE-2021-21702: Fix null pointer dereference in Soap Client

• CVE-2021-21702: Fix null pointer crash because of malformed SOAP server response
• CVE-2021-21703: Fix error in php fpm shared memory organization leading to privilage escalation
• CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
• CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE
• CVE-2023-0568: Fix array overrun when appending slash to paths in DOM and XML cases
• CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed multipart body parts and printing upload limit exceed error message only once
• CVE-2023-3823: Fix external entity loading in XML without enabling it, by sanitizing libxml2 globals before parsing
• CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()

• CVE-2021-21702: fix NULL pointer dereference in SoapClient
• CVE-2021-21703: fix OOB R/W in root process leading to privilege escalation
• CVE-2022-31625: don't free uninitialized parameters in pg_query_params/pg_send_execute that have led to RCE
• CVE-2022-31626: fix mysqlnd/pdo password of excessive length triggering buffer overflow leading to RCE
• CVE-2022-31630: fix OOB read due to insufficient input validation in imageloadfont()
• CVE-2022-37454: fix buffer overflow in the Keccak XKCP SHA-3 reference implementation
• CVE-2023-0662: fix DoS vulnerability when parsing multipart request body

The php packages are updated to version 7.3.27 to fix a Null Dereference in SoapClient (SOAP). (CVE-2021-21702).

Note also php packages version 7.4.15-1.mga7 are available in backports/updates.

This update for php7 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the php7-7.4.24-2.1 package on the GA media of openSUSE Tumbleweed.

This update for php7 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update for php72 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update for php74 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update for php7 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update for php53 fixes the following issues:

• CVE-2021-21702 [bsc#1182049]: NULL pointer dereference in SoapClient

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

This update for php74 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

This update for php7 fixes the following issues:

• Version update to 7.4.33:

• CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

• CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

• Version update to 7.4.32 (jsc#SLE-23639)

• CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

• CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)

USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)