Critical Vulnerability in PHP Packages: Denial of Service Risk
Summary
UBUNTU-CVE-2021-21704: In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(... Affects php5 versions < 5.5.9+dfsg-1ubuntu4.29+esm14. Fixed in 5.5.9+dfsg-1ubuntu4.29+esm14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use and flexibility, making it a popular choice among developers. The affected packages include various versions of PHP (5, 7.0, 7.2, 7.4) that are utilized in numerous web applications. This vulnerability exposes these packages to potential crashes and denial of service due to improper handling of responses from malicious database servers.
Vulnerability Detail
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21, and 8.0.x below 8.0.8, a flaw exists in the Firebird PDO driver extension. A malicious database server can return invalid response data that is not parsed correctly, leading to crashes in various database functions such as getAttribute(), execute(), and fetch(). This can result in denial of service or potentially memory corruption, posing a significant risk to applications relying on these PHP versions.
How To Fix
Minimum fixed version
5.5.9+dfsg-1ubuntu4.29+esm14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the Firebird PDO driver in your PHP configuration to mitigate the risk until the update can be applied. This can be done by commenting out the relevant extension line in your php.ini file:
;extension=php_pdo_firebird.dll
Restart your web server after making this change.
Conclusion
This report highlights a critical vulnerability affecting multiple PHP versions, which can lead to denial of service and memory corruption. It is essential to update to the patched versions of the affected packages to mitigate these risks. Users are encouraged to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for php5 →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
The affected PHP versions are 7.3.x below 7.3.29, 7.4.x below 7.4.21, and 8.0.x below 8.0.8.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include application crashes, denial of service, and possible memory corruption, which can disrupt service availability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
