Server-Side Request Forgery (SSRF) in PHP - CVE-2021-21705

Vulnerability identifier: #VU54565

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2021-21705

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request, bypass the FILTER_VALIDATE_URL and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

PHP
Arch Linux
Amazon Linux AMI
Gentoo Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise Server for SAP
openSUSE Leap
openEuler
Fedora
Junos OS
Red Hat Software Collections
EasyApache
Tenable.sc
php7.3 (Debian package)
rh-php73-php (Red Hat package)
SUSE Linux Enterprise Module for Packagehub Subpackages
libzip
libzip-devel
libzip-tools
php-pear
php-pecl-zip
php-pecl-rrd
php-pecl-xdebug
php-pecl-apcu
php-pecl-apcu-devel
apcu-panel
libapache2-mod-php5 (Ubuntu package)
libapache2-mod-php7.0 (Ubuntu package)
php7.0-cgi (Ubuntu package)
php7.0-cli (Ubuntu package)
php7.0-fpm (Ubuntu package)
php5-cgi (Ubuntu package)
php5-cli (Ubuntu package)
php5-fpm (Ubuntu package)
php72-sysvmsg-debuginfo
php72-pgsql-debuginfo
php72-sysvmsg
php72-sqlite-debuginfo
php72-sqlite
php72-sodium-debuginfo
php72-sodium
php72-sockets-debuginfo
php72-sockets
php72-soap-debuginfo
php72-soap
php72-snmp-debuginfo
php72-snmp
php72-shmop-debuginfo
php72-shmop
php72-readline-debuginfo
php72-readline
php72-pspell-debuginfo
php72-pspell
php72-posix-debuginfo
php72-posix
php72-phar-debuginfo
php72-phar
php72-tokenizer-debuginfo
php72-xmlrpc
php72-pear-Archive_Tar
php72-pear
php72-zlib-debuginfo
php72-zlib
php72-zip-debuginfo
php72-zip
php72-xsl-debuginfo
php72-xsl
php72-xmlwriter-debuginfo
php72-xmlwriter
php72-xmlrpc-debuginfo
php72-sysvsem
php72-xmlreader-debuginfo
php72-xmlreader
php72-wddx-debuginfo
php72-wddx
php72-tokenizer
php72-tidy-debuginfo
php72-tidy
php72-sysvshm-debuginfo
php72-sysvshm
php72-sysvsem-debuginfo
php72-curl-debuginfo
php72-ftp
php72-fpm-debuginfo
php72-fpm
php72-fileinfo-debuginfo
php72-fileinfo
php72-fastcgi-debuginfo
php72-fastcgi
php72-exif-debuginfo
php72-exif
php72-enchant-debuginfo
php72-enchant
php72-dom-debuginfo
php72-dom
php72-dba-debuginfo
php72-dba
php72-pdo-debuginfo
php72-curl
php72-ctype-debuginfo
php72-ctype
php72-calendar-debuginfo
php72-calendar
php72-bz2-debuginfo
php72-bz2
php72-bcmath-debuginfo
php72-bcmath
php72
apache2-mod_php72-debuginfo
apache2-mod_php72
php72-devel
php72-debugsource
php72-debuginfo
php72-gd
php72-ftp-debuginfo
php72-odbc
php72-mysql-debuginfo
php72-mysql
php72-mbstring-debuginfo
php72-mbstring
php72-ldap-debuginfo
php72-ldap
php72-json-debuginfo
php72-odbc-debuginfo
php72-opcache
php72-opcache-debuginfo
php72-openssl
php72-openssl-debuginfo
php72-pcntl
php72-pdo
php72-pgsql
php72-gd-debuginfo
php72-gettext
php72-gettext-debuginfo
php72-gmp
php72-gmp-debuginfo
php72-iconv
php72-imap
php72-imap-debuginfo
php72-intl
php72-intl-debuginfo
php72-json
php72-pcntl-debuginfo
php72-iconv-debuginfo
php-common
php-odbc
php-devel
php-soap
php-recode
php-debugsource
php-fpm
php-embedded
php-json
php-dba
php-debuginfo
php-opcache
php-xmlrpc
php-help
php-pdo
php-bcmath
php-tidy
php-snmp
php
php-intl
php-dbg
php-gd
php-cli
php-gmp
php-enchant
php-process
php-mbstring
php-ldap
php-mysqlnd
php-xml
php-pgsql
php7.2-fpm (Ubuntu package)
php7.2-cli (Ubuntu package)
php7.2-cgi (Ubuntu package)
libapache2-mod-php7.2 (Ubuntu package)
php7.4-cli (Ubuntu package)
php7.4-fpm (Ubuntu package)
php7.4-cgi (Ubuntu package)
libapache2-mod-php7.4 (Ubuntu package)
php74-sysvmsg-debuginfo
php74-xmlreader
php74-tokenizer-debuginfo
php74-tokenizer
php74-tidy-debuginfo
php74-tidy
php74-sysvshm-debuginfo
php74-sysvshm
php74-sysvsem-debuginfo
php74-sysvsem
php74-sysvmsg
php74-xmlreader-debuginfo
php74-xmlrpc
php74-xmlrpc-debuginfo
php74-xmlwriter
php74-xmlwriter-debuginfo
php74-xsl
php74-xsl-debuginfo
php74-zip
php74-zip-debuginfo
php74-zlib
php74-zlib-debuginfo
php74-gettext
php74-fpm-debuginfo
php74-enchant
php74-enchant-debuginfo
php74-exif
php74-exif-debuginfo
php74-fastcgi
php74-fastcgi-debuginfo
php74-fileinfo
php74-fileinfo-debuginfo
php74-fpm
php74-dom-debuginfo
php74-ftp
php74-ftp-debuginfo
php74-gd
php74-gd-debuginfo
php74-gettext-debuginfo
php74-gmp
php74-gmp-debuginfo
php74-iconv
php74-iconv-debuginfo
php74-bz2-debuginfo
php74-debuginfo
php74-debugsource
php74-devel
apache2-mod_php74
apache2-mod_php74-debuginfo
php74
php74-bcmath
php74-bcmath-debuginfo
php74-bz2
php74-sqlite
php74-calendar
php74-calendar-debuginfo
php74-ctype
php74-ctype-debuginfo
php74-curl
php74-curl-debuginfo
php74-dba
php74-dba-debuginfo
php74-dom
php74-shmop-debuginfo
php74-pgsql
php74-pgsql-debuginfo
php74-phar
php74-phar-debuginfo
php74-posix
php74-posix-debuginfo
php74-readline
php74-readline-debuginfo
php74-shmop
php74-intl-debuginfo
php74-snmp
php74-snmp-debuginfo
php74-soap
php74-soap-debuginfo
php74-sockets
php74-sockets-debuginfo
php74-sodium
php74-sodium-debuginfo
php74-sqlite-debuginfo
php74-pdo
php74-intl
php74-json
php74-json-debuginfo
php74-ldap
php74-pdo-debuginfo
php74-ldap-debuginfo
php74-mbstring
php74-mbstring-debuginfo
php74-mysql
php74-odbc
php74-odbc-debuginfo
php74-opcache
php74-opcache-debuginfo
php74-openssl
php74-openssl-debuginfo
php74-pcntl
php74-pcntl-debuginfo
php74-mysql-debuginfo
php7-xmlreader-debuginfo
php7-xmlreader
php7-tokenizer-debuginfo
php7-sysvmsg-debuginfo
php7-tokenizer
php7-tidy-debuginfo
php7-tidy
php7-sysvshm-debuginfo
php7-sysvshm
php7-sysvsem-debuginfo
php7-sysvsem
php7-xmlrpc
php7-xmlrpc-debuginfo
php7-xmlwriter
php7-xmlwriter-debuginfo
php7-xsl-debuginfo
php7-zip
php7-zip-debuginfo
php7-zlib
php7-zlib-debuginfo
php7-embed
php7-embed-debuginfo
php7-xsl
php7-gd
php7-enchant-debuginfo
php7-exif
php7-exif-debuginfo
php7-fastcgi
php7-fastcgi-debuginfo
php7-fileinfo
php7-fileinfo-debuginfo
php7-fpm
php7-fpm-debuginfo
php7-ftp
php7-ftp-debuginfo
php7-enchant
php7-gd-debuginfo
php7-gettext
php7-gettext-debuginfo
php7-gmp
php7-gmp-debuginfo
php7-iconv
php7-iconv-debuginfo
php7-intl
php7-intl-debuginfo
php7-json
php7-ctype
apache2-mod_php7
apache2-mod_php7-debuginfo
php7
php7-bcmath
php7-bcmath-debuginfo
php7-sysvmsg
php7-bz2
php7-bz2-debuginfo
php7-calendar
php7-calendar-debuginfo
php7-sqlite-debuginfo
php7-ctype-debuginfo
php7-curl
php7-curl-debuginfo
php7-dba
php7-dba-debuginfo
php7-debuginfo
php7-debugsource
php7-devel
php7-dom
php7-dom-debuginfo
php7-shmop-debuginfo
php7-pdo
php7-pdo-debuginfo
php7-pgsql
php7-pgsql-debuginfo
php7-phar
php7-phar-debuginfo
php7-posix
php7-posix-debuginfo
php7-readline
php7-readline-debuginfo
php7-shmop
php7-ldap
php7-snmp
php7-snmp-debuginfo
php7-soap
php7-soap-debuginfo
php7-json-debuginfo
php7-sqlite
php7-sodium-debuginfo
php7-sodium
php7-sockets-debuginfo
php7-sockets
php7-openssl
php7-odbc
php7-odbc-debuginfo
php7-opcache
php7-opcache-debuginfo
php7-mysql-debuginfo
php7-mysql
php7-mbstring-debuginfo
php7-mbstring
php7-openssl-debuginfo
php7-ldap-debuginfo
php7-pcntl
php7-pcntl-debuginfo
php-ffi
php7-test
php7-firebird
php7-firebird-debuginfo
HP-UX PHP
Oracle SD-WAN Aware

Install updates from vendor's website.

PHP - addressed in versions 7.3.29, 7.4.21, 8.0.8
EasyApache - update to 4 2021-7-7
Tenable.sc - update to 5.19.0
php7.3 (Debian package) - update to 7.3.29-1~deb10u1
rh-php73-php (Red Hat package) - update to 7.3.29-1.el7
libzip - update to 1.6.1-1
libzip-devel - update to 1.6.1-1
libzip-tools - update to 1.6.1-1
php-pear - update to 1.10.12-1
php-pecl-zip - update to 1.18.2-1
php-pecl-rrd - update to 2.0.1-1
php-pecl-xdebug - update to 2.9.5-1
php-pecl-apcu - update to 5.1.18-1
php-pecl-apcu-devel - update to 5.1.18-1
apcu-panel - update to 5.1.18-1
libapache2-mod-php5 (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
libapache2-mod-php7.0 (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php7.0-cgi (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php7.0-cli (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php7.0-fpm (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php5-cgi (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php5-cli (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php5-fpm (Ubuntu package) - update to 7.0.330ubuntu0.16.04.16+esm1
php72-sysvmsg-debuginfo - update to 7.2.5-1.63.2
php72-pgsql-debuginfo - update to 7.2.5-1.63.2
php72-sysvmsg - update to 7.2.5-1.63.2
php72-sqlite-debuginfo - update to 7.2.5-1.63.2
php72-sqlite - update to 7.2.5-1.63.2
php72-sodium-debuginfo - update to 7.2.5-1.63.2
php72-sodium - update to 7.2.5-1.63.2
php72-sockets-debuginfo - update to 7.2.5-1.63.2
php72-sockets - update to 7.2.5-1.63.2
php72-soap-debuginfo - update to 7.2.5-1.63.2
php72-soap - update to 7.2.5-1.63.2
php72-snmp-debuginfo - update to 7.2.5-1.63.2
php72-snmp - update to 7.2.5-1.63.2
php72-shmop-debuginfo - update to 7.2.5-1.63.2
php72-shmop - update to 7.2.5-1.63.2
php72-readline-debuginfo - update to 7.2.5-1.63.2
php72-readline - update to 7.2.5-1.63.2
php72-pspell-debuginfo - update to 7.2.5-1.63.2
php72-pspell - update to 7.2.5-1.63.2
php72-posix-debuginfo - update to 7.2.5-1.63.2
php72-posix - update to 7.2.5-1.63.2
php72-phar-debuginfo - update to 7.2.5-1.63.2
php72-phar - update to 7.2.5-1.63.2
php72-tokenizer-debuginfo - update to 7.2.5-1.63.2
php72-xmlrpc - update to 7.2.5-1.63.2
php72-pear-Archive_Tar - update to 7.2.5-1.63.2
php72-pear - update to 7.2.5-1.63.2
php72-zlib-debuginfo - update to 7.2.5-1.63.2
php72-zlib - update to 7.2.5-1.63.2
php72-zip-debuginfo - update to 7.2.5-1.63.2
php72-zip - update to 7.2.5-1.63.2
php72-xsl-debuginfo - update to 7.2.5-1.63.2
php72-xsl - update to 7.2.5-1.63.2
php72-xmlwriter-debuginfo - update to 7.2.5-1.63.2
php72-xmlwriter - update to 7.2.5-1.63.2
php72-xmlrpc-debuginfo - update to 7.2.5-1.63.2
php72-sysvsem - update to 7.2.5-1.63.2
php72-xmlreader-debuginfo - update to 7.2.5-1.63.2
php72-xmlreader - update to 7.2.5-1.63.2
php72-wddx-debuginfo - update to 7.2.5-1.63.2
php72-wddx - update to 7.2.5-1.63.2
php72-tokenizer - update to 7.2.5-1.63.2
php72-tidy-debuginfo - update to 7.2.5-1.63.2
php72-tidy - update to 7.2.5-1.63.2
php72-sysvshm-debuginfo - update to 7.2.5-1.63.2
php72-sysvshm - update to 7.2.5-1.63.2
php72-sysvsem-debuginfo - update to 7.2.5-1.63.2
php72-curl-debuginfo - update to 7.2.5-1.63.2
php72-ftp - update to 7.2.5-1.63.2
php72-fpm-debuginfo - update to 7.2.5-1.63.2
php72-fpm - update to 7.2.5-1.63.2
php72-fileinfo-debuginfo - update to 7.2.5-1.63.2
php72-fileinfo - update to 7.2.5-1.63.2
php72-fastcgi-debuginfo - update to 7.2.5-1.63.2
php72-fastcgi - update to 7.2.5-1.63.2
php72-exif-debuginfo - update to 7.2.5-1.63.2
php72-exif - update to 7.2.5-1.63.2
php72-enchant-debuginfo - update to 7.2.5-1.63.2
php72-enchant - update to 7.2.5-1.63.2
php72-dom-debuginfo - update to 7.2.5-1.63.2
php72-dom - update to 7.2.5-1.63.2
php72-dba-debuginfo - update to 7.2.5-1.63.2
php72-dba - update to 7.2.5-1.63.2
php72-pdo-debuginfo - update to 7.2.5-1.63.2
php72-curl - update to 7.2.5-1.63.2
php72-ctype-debuginfo - update to 7.2.5-1.63.2
php72-ctype - update to 7.2.5-1.63.2
php72-calendar-debuginfo - update to 7.2.5-1.63.2
php72-calendar - update to 7.2.5-1.63.2
php72-bz2-debuginfo - update to 7.2.5-1.63.2
php72-bz2 - update to 7.2.5-1.63.2
php72-bcmath-debuginfo - update to 7.2.5-1.63.2
php72-bcmath - update to 7.2.5-1.63.2
php72 - update to 7.2.5-1.63.2
apache2-mod_php72-debuginfo - update to 7.2.5-1.63.2
apache2-mod_php72 - update to 7.2.5-1.63.2
php72-devel - update to 7.2.5-1.63.2
php72-debugsource - update to 7.2.5-1.63.2
php72-debuginfo - update to 7.2.5-1.63.2
php72-gd - update to 7.2.5-1.63.2
php72-ftp-debuginfo - update to 7.2.5-1.63.2
php72-odbc - update to 7.2.5-1.63.2
php72-mysql-debuginfo - update to 7.2.5-1.63.2
php72-mysql - update to 7.2.5-1.63.2
php72-mbstring-debuginfo - update to 7.2.5-1.63.2
php72-mbstring - update to 7.2.5-1.63.2
php72-ldap-debuginfo - update to 7.2.5-1.63.2
php72-ldap - update to 7.2.5-1.63.2
php72-json-debuginfo - update to 7.2.5-1.63.2
php72-odbc-debuginfo - update to 7.2.5-1.63.2
php72-opcache - update to 7.2.5-1.63.2
php72-opcache-debuginfo - update to 7.2.5-1.63.2
php72-openssl - update to 7.2.5-1.63.2
php72-openssl-debuginfo - update to 7.2.5-1.63.2
php72-pcntl - update to 7.2.5-1.63.2
php72-pdo - update to 7.2.5-1.63.2
php72-pgsql - update to 7.2.5-1.63.2
php72-gd-debuginfo - update to 7.2.5-1.63.2
php72-gettext - update to 7.2.5-1.63.2
php72-gettext-debuginfo - update to 7.2.5-1.63.2
php72-gmp - update to 7.2.5-1.63.2
php72-gmp-debuginfo - update to 7.2.5-1.63.2
php72-iconv - update to 7.2.5-1.63.2
php72-imap - update to 7.2.5-1.63.2
php72-imap-debuginfo - update to 7.2.5-1.63.2
php72-intl - update to 7.2.5-1.63.2
php72-intl-debuginfo - update to 7.2.5-1.63.2
php72-json - update to 7.2.5-1.63.2
php72-pcntl-debuginfo - update to 7.2.5-1.63.2
php72-iconv-debuginfo - update to 7.2.5-1.63.2
php-common - update to 7.2.10-15
php-odbc - update to 7.2.10-15
php-devel - update to 7.2.10-15
php-soap - update to 7.2.10-15
php-recode - update to 7.2.10-15
php-debugsource - update to 7.2.10-15
php-fpm - update to 7.2.10-15
php-embedded - update to 7.2.10-15
php-json - update to 7.2.10-15
php-dba - update to 7.2.10-15
php-debuginfo - update to 7.2.10-15
php-opcache - update to 7.2.10-15
php-xmlrpc - update to 7.2.10-15
php-help - update to 7.2.10-15
php-pdo - update to 7.2.10-15
php-bcmath - update to 7.2.10-15
php-tidy - update to 7.2.10-15
php-snmp - update to 7.2.10-15
php - update to 7.2.10-15
php-intl - update to 7.2.10-15
php-dbg - update to 7.2.10-15
php-gd - update to 7.2.10-15
php-cli - update to 7.2.10-15
php-gmp - update to 7.2.10-15
php-enchant - update to 7.2.10-15
php-process - update to 7.2.10-15
php-mbstring - update to 7.2.10-15
php-ldap - update to 7.2.10-15
php-mysqlnd - update to 7.2.10-15
php-xml - update to 7.2.10-15
php-pgsql - update to 7.2.10-15
php7.2-fpm (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.8
php7.2-cli (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.8
php7.2-cgi (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.8
libapache2-mod-php7.2 (Ubuntu package) - update to 7.2.24-0ubuntu0.18.04.8
php7.4-cli (Ubuntu package) - addressed in versions 7.4.3-4ubuntu2.5, 7.4.9-1ubuntu1.2, 7.4.16-1ubuntu2.1
php7.4-fpm (Ubuntu package) - addressed in versions 7.4.3-4ubuntu2.5, 7.4.9-1ubuntu1.2, 7.4.16-1ubuntu2.1
php7.4-cgi (Ubuntu package) - addressed in versions 7.4.3-4ubuntu2.5, 7.4.9-1ubuntu1.2, 7.4.16-1ubuntu2.1
libapache2-mod-php7.4 (Ubuntu package) - addressed in versions 7.4.3-4ubuntu2.5, 7.4.9-1ubuntu1.2, 7.4.16-1ubuntu2.1
php74-sysvmsg-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlreader - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-tokenizer-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-tokenizer - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-tidy-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-tidy - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sysvshm-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sysvshm - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sysvsem-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sysvsem - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sysvmsg - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlreader-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlrpc - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlrpc-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlwriter - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xmlwriter-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xsl - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-xsl-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-zip - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-zip-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-zlib - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-zlib-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gettext - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fpm-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-enchant - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-enchant-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-exif - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-exif-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fastcgi - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fastcgi-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fileinfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fileinfo-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-fpm - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-dom-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ftp - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ftp-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gd - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gd-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gettext-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gmp - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-gmp-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-iconv - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-iconv-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-bz2-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-debugsource - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-devel - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
apache2-mod_php74 - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
apache2-mod_php74-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74 - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-bcmath - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-bcmath-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-bz2 - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sqlite - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-calendar - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-calendar-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ctype - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ctype-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-curl - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-curl-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-dba - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-dba-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-dom - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-shmop-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pgsql - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pgsql-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-phar - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-phar-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-posix - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-posix-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-readline - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-readline-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-shmop - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-intl-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-snmp - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-snmp-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-soap - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-soap-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sockets - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sockets-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sodium - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sodium-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-sqlite-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pdo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-intl - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-json - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-json-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ldap - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pdo-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-ldap-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-mbstring - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-mbstring-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-mysql - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-odbc - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-odbc-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-opcache - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-opcache-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-openssl - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-openssl-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pcntl - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-pcntl-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php74-mysql-debuginfo - addressed in versions 7.4.6-1.24.1, 7.4.33-1.47.2
php7-xmlreader-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xmlreader - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-tokenizer-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvmsg-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-tokenizer - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-tidy-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-tidy - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvshm-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvshm - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvsem-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvsem - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xmlrpc - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xmlrpc-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xmlwriter - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xmlwriter-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xsl-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-zip - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-zip-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-zlib - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-zlib-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-embed - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-embed-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-xsl - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gd - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-enchant-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-exif - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-exif-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fastcgi - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fastcgi-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fileinfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fileinfo-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fpm - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-fpm-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ftp - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ftp-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-enchant - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gd-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gettext - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gettext-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gmp - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-gmp-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-iconv - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-iconv-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-intl - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-intl-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-json - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ctype - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
apache2-mod_php7 - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
apache2-mod_php7-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7 - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-bcmath - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-bcmath-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sysvmsg - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-bz2 - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-bz2-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-calendar - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-calendar-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sqlite-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ctype-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-curl - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-curl-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-dba - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-dba-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-debugsource - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-devel - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-dom - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-dom-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-shmop-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pdo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pdo-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pgsql - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pgsql-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-phar - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-phar-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-posix - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-posix-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-readline - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-readline-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-shmop - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ldap - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-snmp - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-snmp-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-soap - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-soap-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-json-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sqlite - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sodium-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sodium - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sockets-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-sockets - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-openssl - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-odbc - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-odbc-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-opcache - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-opcache-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-mysql-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-mysql - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-mbstring-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-mbstring - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-openssl-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-ldap-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pcntl - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php7-pcntl-debuginfo - addressed in versions 7.4.6-3.22.1, 7.4.33-150200.3.46.2
php-soap - update to 7.4.19-2.0.1
php-snmp - update to 7.4.19-2.0.1
php-process - update to 7.4.19-2.0.1
php-xml - update to 7.4.19-2.0.1
php-pgsql - update to 7.4.19-2.0.1
php-xmlrpc - update to 7.4.19-2.0.1
php-pdo - update to 7.4.19-2.0.1
php-opcache - update to 7.4.19-2.0.1
php-odbc - update to 7.4.19-2.0.1
php-common - update to 7.4.19-2.0.1
php-mysqlnd - update to 7.4.19-2.0.1
php-mbstring - update to 7.4.19-2.0.1
php-embedded - update to 7.4.19-2.0.1
php-ldap - update to 7.4.19-2.0.1
php - update to 7.4.19-2.0.1
php-bcmath - update to 7.4.19-2.0.1
php-cli - update to 7.4.19-2.0.1
php-dba - update to 7.4.19-2.0.1
php-dbg - update to 7.4.19-2.0.1
php-devel - update to 7.4.19-2.0.1
php-enchant - update to 7.4.19-2.0.1
php-ffi - update to 7.4.19-2.0.1
php-fpm - update to 7.4.19-2.0.1
php-gd - update to 7.4.19-2.0.1
php-gmp - update to 7.4.19-2.0.1
php-intl - update to 7.4.19-2.0.1
php-json - update to 7.4.19-2.0.1
php - addressed in versions 7.4.21-1.fc33, 7.4.21-1.fc34
php7-test - update to 7.4.33-150200.3.46.2
php7-firebird - update to 7.4.33-150200.3.46.2
php7-firebird-debuginfo - update to 7.4.33-150200.3.46.2
HP-UX PHP - update to 8.1.14.1
Junos OS - update to 23.2R1

• https://www.php.net/ChangeLog-8.php#8.0.8
• https://www.php.net/ChangeLog-7.php#7.4.21
• https://www.php.net/ChangeLog-7.php#7.3.29
• https://bugs.php.net/bug.php?id=81122

• Multiple vulnerabilities in PHP
• Arch Linux update for php7
• Arch Linux update for php
• Debian update for php7.3
• Multiple vulnerabilities in cPanel EasyApache
• Multiple vulnerabilities in Tenable.sc
• Red Hat Software Collections update for rh-php73-php
• Amazon Linux AMI update for php73
• Server-Side Request Forgery (SSRF) in Oracle SD-WAN Aware
• Red Hat Enterprise Linux 8 update for the php:7.4 module
• SUSE update for php72
• SUSE update for php74
• SUSE update for php7
• Ubuntu update for php7.2
• Ubuntu update for php5
• Gentoo update for PHP
• SUSE update for php74
• SUSE update for php7
• Juniper Junos OS J-Web update for PHP
• openEuler update for php
• Fedora 33 update for php
• Fedora 34 update for php
• Anolis OS update for php:7.4 module
• Multiple vulnerabilities in HP-UX PHP