Strix
26.1K

CVE-2021-21979

HIGHCVSS 7.3/10EPSS 0.65%

Last modified

CVE-2021-21979 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. EPSS estimates a 0.65% chance of exploitation in the next 30 days.

Description

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.

Metrics

CVSS 3.1
7.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Probability
0.65%

46.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
BitnamiContainers>= 6.0.2-debian-9-r0, <= 6.0.2-debian-9-r22
BitnamiContainers>= 6.4.0-debian-9-r0, <= 6.4.0-debian-9-r31
BitnamiContainers>= 6.5.2-debian-9-r0, <= 6.5.2-debian-9-r20
BitnamiContainers>= 6.8.0-debian-9-r0, <= 6.8.0-debian-9-r26
BitnamiContainers>= 6.12.0-debian-9-r0, <= 6.12.0-debian-10-r33
BitnamiContainers>= 6.18.0-debian-10-r0, <= 6.18.0-debian-10-r21
BitnamiContainers>= 6.18.3-debian-10-r0, <= 6.18.3-debian-10-r22
BitnamiContainers>= 6.18.8-debian-10-r0, <= 6.18.8-debian-10-r110
BitnamiContainers>= 6.18.35-debian-10-r0, <= 6.18.35-debian-10-r66
BitnamiContainers>= 6.20.0-debian-10-r0, < 6.20.0-debian-10-r107
BitnamiContainers>= 7.0.0-debian-10-r0, <= 7.0.0-debian-10-r7
BitnamiContainers>= 7.3.0-debian-10-r0, <= 7.3.0-debian-10-r20
BitnamiContainers>= 7.6.0-debian-10-r0, <= 7.6.0-debian-10-r38
BitnamiContainers>= 7.12.0-debian-10-r0, <= 7.12.0-debian-10-r72
BitnamiContainers>= 7.25.0-debian-10-r0, <= 7.25.0-debian-10-r16
BitnamiContainers>= 7.28.0-debian-10-r0, <= 7.28.0-debian-10-r50
BitnamiContainers>= 7.30.1-debian-10-r0, < 7.30.1-debian-10-r108
BitnamiContainers>= 8.0.1-debian-10-r0, <= 8.0.1-debian-10-r7
BitnamiContainers>= 8.0.3-debian-10-r0, <= 8.0.3-debian-10-r18
BitnamiContainers>= 8.1.0-debian-10-r0, <= 8.1.0-debian-10-r7
BitnamiContainers>= 8.2.0-debian-10-r0, <= 8.2.0-debian-10-r8
BitnamiContainers>= 8.4.0-debian-10-r0, <= 8.4.0-debian-10-r10
BitnamiContainers>= 8.4.1-debian-10-r0, <= 8.4.1-debian-10-r6
BitnamiContainers>= 8.4.2-debian-10-r0, <= 8.4.2-debian-10-r4
BitnamiContainers>= 8.4.3-debian-10-r0, <= 8.4.3-debian-10-r6
BitnamiContainers>= 8.4.4-debian-10-r0, <= 8.4.4-debian-10-r6
BitnamiContainers>= 8.5.5-debian-10-r0, <= 8.5.5-debian-10-r11
BitnamiContainers>= 8.5.6-debian-10-r0, <= 8.5.6-debian-10-r13
BitnamiContainers>= 8.5.7-debian-10-r0, <= 8.5.7-debian-10-r6
BitnamiContainers>= 8.5.8-debian-10-r0, <= 8.5.8-debian-10-r5
BitnamiContainers>= 8.5.9-debian-10-r0, <= 8.5.9-debian-10-r25
BitnamiContainers>= 8.5.10-debian-10-r0, <= 8.5.10-debian-10-r6
BitnamiContainers6.19.0-debian-10-r0
BitnamiContainers7.29.0-debian-10-r0
BitnamiContainers7.30.0-debian-10-r0
BitnamiContainers8.3.0-debian-10-r0
BitnamiContainers8.5.2-debian-10-r0
BitnamiContainers8.5.2-debian-10-r1
BitnamiContainers8.5.3-debian-10-r0
BitnamiContainers8.5.4-debian-10-r0
BitnamiContainers8.5.4-debian-10-r1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-21979?
In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.
How severe is CVE-2021-21979?
CVE-2021-21979 has a CVSS score of 7.3/10 (HIGH severity). The EPSS model estimates a 0.65% probability of exploitation in the next 30 days.
How do I fix CVE-2021-21979?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-21979?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST