[ASA-202107-16] php7: multiple issues

[Jonas Witschel]

Arch Linux Security Advisory ASA-202107-16
==========================================

Severity: Medium
Date    : 2021-07-06
CVE-ID  : CVE-2021-21704 CVE-2021-21705
Package : php7
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2133

Summary
=======

The package php7 before version 7.4.21-1 is vulnerable to multiple
issues including denial of service and insufficient validation.

Resolution
==========

Upgrade to 7.4.21-1.

# pacman -Syu "php7>=7.4.21-1"

The problems have been fixed upstream in version 7.4.21.

Workaround
==========

None.

Description
===========

- CVE-2021-21704 (denial of service)

Multiple bugs in the pdo_firebase module allow a malicious firebase
server or man-in-the-middle attacker to crash PHP before versions 8.0.8
and 7.4.21.

- CVE-2021-21705 (insufficient validation)

A security issue was found in the php_url_parse_ex() function in PHP
before versions 8.0.8 and 7.4.21, which leads to FILTER_VALIDATE_URL
accepting URLs with invalid userinfo, a different issue from
CVE-2020-7071.

Impact
======

A remote user could bypass URL validation. Furthermore, a malicious
firebase server or man-in-the-middle attacker could crash a PHP
application.

References
==========

https://www.php.net/ChangeLog-8.php#8.0.8
https://www.php.net/ChangeLog-7.php#7.4.21
https://bugs.php.net/bug.php?id=76448
https://bugs.php.net/bug.php?id=76449
https://bugs.php.net/bug.php?id=76450
https://bugs.php.net/bug.php?id=76452
https://github.com/php/php-src/commit/1edd284cd56ce4c23f6fdf66050e4a722e6515c5
https://github.com/php/php-src/commit/8cb87aabba0b2e284428aabca13401d1ad54bc97
https://github.com/php/php-src/commit/921f320ec2baabd24e5ff182d9fb73092eb28676
https://github.com/php/php-src/commit/c8620a753114fac789016a4e6ae9c9b1210be10f
https://github.com/php/php-src/commit/1d4c3114afe8f7dde51f917cd14dc4600a3a40f0
https://github.com/php/php-src/commit/922ea3419923c74471f01ff8c6ea30f0a07d8e19
https://github.com/php/php-src/commit/08fc2960bccd4f04031d10099c82cf8d76cfa501
https://github.com/php/php-src/commit/e92d5edeeeed809bc3a06b165e4f0a63bcabdb92
https://bugs.php.net/bug.php?id=81122
https://github.com/php/php-src/commit/5a1fe88ac120d71064bdd314dce1e49c86ff0585
https://github.com/php/php-src/commit/5cea97e083448aaa2352320612541c895178b3b5
https://security.archlinux.org/CVE-2021-21704
https://security.archlinux.org/CVE-2021-21705
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20210709/4190e16b/attachment.sig>