CVE-2021-21705 Incorrect URL validation in FILTER_VALIDATE_URL

What is CVE-2021-21705?

CVE-2021-21705 is a medium-severity vulnerability in Netapp Clustered Data Ontap, published on 4 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a wrong access decision.

Weakness: CWE-20

Which versions are affected by CVE-2021-21705?

3 open source packages ship an affected version, including libphp, php and php-min. It affects 3 products.

Products include Netapp Clustered Data Ontap, Oracle Sd-Wan Aware, Php Php.

How do I fix CVE-2021-21705?

Upgrade libphp to a fixed version for your release line: 7.3.29, 7.4.21 or 8.0.8.

Is CVE-2021-21705 being exploited?

There is no known exploitation of CVE-2021-21705 in the wild and no public exploit code.

Other vulnerabilities in Netapp Clustered Data Ontap

• CVE-2015-7853 Integer overflow in n/a Critical 9.8
• CVE-2017-9119 Denial of service in n/a Critical 9.8
• CVE-2016-7480 Deserialization in PHP before 7.0.12 Critical 9.8
• CVE-2017-5340 Integer overflow in n/a Critical 9.8
• CVE-2017-11147 Information disclosure in n/a Critical 9.1

All Netapp Clustered Data Ontap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-libphp-2021-21705, BIT-php-2021-21705, BIT-php-min-2021-21705, CLSA-2022-1654526233, CLSA-2022-1654526615, DEBIAN-CVE-2021-21705 and 5 more.