Vulnerability CVE-2021-21706: Information

Description

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2021-21706
Published: Oct. 4, 2021
Modified: Nov. 3, 2021
Error type identifier: CWE-22

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
php7p107.4.24-alt17.4.33-alt1ALT-PU-2021-2943-1285926Fixed
php7p97.3.31-alt17.3.33-alt1ALT-PU-2021-2937-1285609Fixed
php7c10f17.4.24-alt17.4.33-alt1ALT-PU-2021-2943-1285926Fixed
php7c9f27.3.31-alt17.4.33-alt1ALT-PU-2021-3079-1287613Fixed
php8.0p108.0.11-alt18.0.30-alt1ALT-PU-2021-2971-1285866Fixed
php8.0c10f18.0.11-alt18.0.30-alt1ALT-PU-2021-2971-1285866Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
N/A
  • Issue Tracking
  • Patch
  • Vendor Advisory
https://security.netapp.com/advisory/ntap-20211029-0007/
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
      cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top