CVE-2021-21702: Null Dereference in SoapClient
Fixed bug (Null Dereference in SoapClient). (CVE-2021-21702)
Other sources
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this bug?
The vulnerability ID for this bug is CVE-2021-21702.
What is the title of this bug?
The title of this bug is 'Fixed bug (Null Dereference in SoapClient). (CVE-2021-21702)'
What is the description of this bug?
In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.
What is the severity of CVE-2021-21702?
The severity of CVE-2021-21702 is high with a CVSS score of 7.5.
How can I fix CVE-2021-21702?
To fix CVE-2021-21702, update PHP to version 8.0.2 if you are using PHP 8.0.x, and update to the latest available versions if you are using PHP 7.3.x or 7.4.x.
Where can I find more information about CVE-2021-21702?
You can find more information about CVE-2021-21702 at the following references: [link1], [link2], [link3].