Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458)

Résumé

Filter bypass in filter_var (FILTER_VALIDATE_URL)

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.29"},{"introduced":"8.2.0"},{"fixed":"8.2.20"},{"introduced":"8.3.0"},{"fixed":"8.3.8"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2024-5458 php7.4 Corrigé dans: 7.4.33-1+deb11u6

Résumé

Description d'origine

Paquets affectés

État des correctifs par distribution

Références