Vulnerability Details CVE-2021-21702
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 37.9%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
- https://bugs.php.net/bug.php?id=80672
- https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html
- https://security.gentoo.org/glsa/202105-23
- https://security.netapp.com/advisory/ntap-20210312-0005/
- https://www.debian.org/security/2021/dsa-4856
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.tenable.com/security/tns-2021-14
- https://bugs.php.net/bug.php?id=80672
- https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html
- https://security.gentoo.org/glsa/202105-23
- https://security.netapp.com/advisory/ntap-20210312-0005/
- https://www.debian.org/security/2021/dsa-4856
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.tenable.com/security/tns-2021-14
Products affected by CVE-2021-21702
-
cpe:2.3:a:netapp:clustered_data_ontap:-
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0.0
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.2
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.3
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.3.0.0
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.0
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.4.0.5
-
cpe:2.3:a:oracle:communications_diameter_signaling_router:8.5.0
-
cpe:2.3:a:php:php:7.3.0
-
cpe:2.3:a:php:php:7.3.1
-
cpe:2.3:a:php:php:7.3.10
-
cpe:2.3:a:php:php:7.3.11
-
cpe:2.3:a:php:php:7.3.12
-
cpe:2.3:a:php:php:7.3.13
-
cpe:2.3:a:php:php:7.3.14
-
cpe:2.3:a:php:php:7.3.15
-
cpe:2.3:a:php:php:7.3.16
-
cpe:2.3:a:php:php:7.3.17
-
cpe:2.3:a:php:php:7.3.18
-
cpe:2.3:a:php:php:7.3.19
-
cpe:2.3:a:php:php:7.3.2
-
cpe:2.3:a:php:php:7.3.20
-
cpe:2.3:a:php:php:7.3.21
-
cpe:2.3:a:php:php:7.3.22
-
cpe:2.3:a:php:php:7.3.23
-
cpe:2.3:a:php:php:7.3.24
-
cpe:2.3:a:php:php:7.3.25
-
cpe:2.3:a:php:php:7.3.26
-
cpe:2.3:a:php:php:7.3.3
-
cpe:2.3:a:php:php:7.3.4
-
cpe:2.3:a:php:php:7.3.5
-
cpe:2.3:a:php:php:7.3.6
-
cpe:2.3:a:php:php:7.3.7
-
cpe:2.3:a:php:php:7.3.8
-
cpe:2.3:a:php:php:7.3.9
-
cpe:2.3:a:php:php:7.4.0
-
cpe:2.3:a:php:php:7.4.1
-
cpe:2.3:a:php:php:7.4.10
-
cpe:2.3:a:php:php:7.4.11
-
cpe:2.3:a:php:php:7.4.12
-
cpe:2.3:a:php:php:7.4.13
-
cpe:2.3:a:php:php:7.4.14
-
cpe:2.3:a:php:php:7.4.2
-
cpe:2.3:a:php:php:7.4.3
-
cpe:2.3:a:php:php:7.4.4
-
cpe:2.3:a:php:php:7.4.5
-
cpe:2.3:a:php:php:7.4.6
-
cpe:2.3:a:php:php:7.4.7
-
cpe:2.3:a:php:php:7.4.8
-
cpe:2.3:a:php:php:7.4.9
-
cpe:2.3:a:php:php:8.0.0
-
cpe:2.3:a:php:php:8.0.1
-
cpe:2.3:o:debian:debian_linux:10.0
-
cpe:2.3:o:debian:debian_linux:9.0