Detections
Analytics

Alpine: php7: security update to 7.3.33-r0

medium Tenable Cloud Security Plugin ID 406346

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing
 functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains
 URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus
 interpreting the filename differently from what the user intended, which may lead it to reading a
 different file than intended. (CVE-2021-21707)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-21707

Plugin Details

Severity: Medium

ID: 406346

Version: Revision 1.25

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 50.89

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-21707

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 11/15/2021

Reference Information

CVE: CVE-2021-21707

IAVA: 2021-A-0566-S