Filter bypass in filter_var (FILTER_VALIDATE_URL)
Summary
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Original description
The description as published by the source.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-5458 php7.4 Fixed in: 7.4.33-1+deb11u6
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- package github.com
- web openwall.com
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.debian.org