Ubuntu
php7.4 package

CVE-2021-21708: potential RCE with filter_var(..., FILTER_VALIDATE_FLOAT)

Bug #1961820 reported by Matt Coleman
260
This bug affects 2 people
Affects Status Importance Assigned to Milestone
php7.4 (Ubuntu)
Fix Released
Undecided
Rodrigo Figueiredo Zaiden
php8.0 (Ubuntu)
Fix Released
Undecided
Rodrigo Figueiredo Zaiden

Bug Description

This article was recently posted about a vulnerability with potential for RCE in PHP's FILTER_VALIDATE_FLOAT functionality:
https://nakedsecurity.sophos.com/2022/02/18/irony-alert-php-fixes-security-flaw-in-input-validation-code/

It has been fixed in PHP 7.4.28.

Canonical has already documented the CVE and given it a "Medium" rating:
https://ubuntu.com/security/CVE-2021-21708

Red Hat gave it a 6.6 rating:
https://access.redhat.com/security/cve/cve-2021-21708

CVE References

Matt Coleman (mcoleman)
information type: Private Security → Public Security
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in php7.4 (Ubuntu):
status: New → Confirmed
Rodrigo Figueiredo Zaiden (rodrigo-zaiden)
Changed in php7.4 (Ubuntu):
status: Confirmed → In Progress
assignee: nobody → Rodrigo Figueiredo Zaiden (rodrigo-zaiden)
Rodrigo Figueiredo Zaiden (rodrigo-zaiden)
Changed in php8.0 (Ubuntu):
assignee: nobody → Rodrigo Figueiredo Zaiden (rodrigo-zaiden)
status: New → In Progress
Revision history for this message
Rodrigo Figueiredo Zaiden (rodrigo-zaiden) wrote :

This bug was fixed in the package php7.4 - 7.4.3-4ubuntu2.9

---------------
php7.4 (7.4.3-4ubuntu2.9) focal-security; urgency=medium

  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2021-21708.patch: change the call to
      zval_ptr_dtor in ext/filter/logical_filters.c to be done
      after a validation is succeeded, and add a test for this
      case in ext/filter/tests/bug81708.phpt
    - CVE-2021-21708

 -- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 24 Feb 2022 11:55:48 -0300

Changed in php7.4 (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Rodrigo Figueiredo Zaiden (rodrigo-zaiden) wrote :

This bug was fixed in the package php8.0 - 8.0.8-1ubuntu0.2

---------------
php8.0 (8.0.8-1ubuntu0.2) impish-security; urgency=medium

  * SECURITY UPDATE: Use after free
    - debian/patches/CVE-2021-21708.patch: change the call to
      zval_ptr_dtor in ext/filter/logical_filters.c to be done
      after a validation is succeeded, and add a test for this
      case in ext/filter/tests/bug81708.phpt
    - CVE-2021-21708

 -- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 24 Feb 2022 12:03:09 -0300

Changed in php8.0 (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.