Strix
26.1K

CVE-2021-21704

MEDIUMCVSS 5.9/10EPSS 1.73%

Last modified

CVE-2021-21704 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.. EPSS estimates a 1.73% chance of exploitation in the next 30 days.

Description

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.

Metrics

CVSS 3.1
5.9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
1.73%

74.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
PhpPhp>= 7.3.0, < 7.3.29
PhpPhp>= 7.4.0, < 7.4.21
PhpPhp>= 8.0.0, < 8.0.8
NetappClustered Data OntapAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-21704?
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
How severe is CVE-2021-21704?
CVE-2021-21704 has a CVSS score of 5.9/10 (MEDIUM severity). The EPSS model estimates a 1.73% probability of exploitation in the next 30 days.
How do I fix CVE-2021-21704?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-21704?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST