CVE-2020-7071

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filtervar($url, FILTERVALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type: GIT
Repo: https://github.com/php/php-src
Events: Introduced

52ace952a1b65ca80fc2617f11c2fa6dd03f51bd

Fixed

d4f5aed22193106271510efd643ba8f349b7d85f

Database specific

{
    "vanir_signatures": [
        {
            "deprecated": false,
            "source": "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
            "target": {
                "file": "ext/standard/url.c"
            },
            "digest": {
                "line_hashes": [
                    "227590726783538602739410841003471904793",
                    "66680938880302284338338960787911270257",
                    "171183897526155539642673019964330521437",
                    "148221363525494540717156201398603599226",
                    "14027080294252728254363174975924474113",
                    "76883004995448503163927027256011056830",
                    "64543593176252355754339515403925011044",
                    "12108129512617529725365468371233867917",
                    "100947579209271428937666099495064218656",
                    "101484631618889424068088575429425243002",
                    "283402044833093694227510714613320421908"
                ],
                "threshold": 0.9
            },
            "id": "CVE-2020-7071-bd47661d",
            "signature_version": "v1",
            "signature_type": "Line"
        },
        {
            "deprecated": false,
            "source": "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
            "target": {
                "function": "php_url_parse_ex2",
                "file": "ext/standard/url.c"
            },
            "digest": {
                "function_hash": "104833949699379374291448524444507709786",
                "length": 4481.0
            },
            "id": "CVE-2020-7071-fe94b820",
            "signature_version": "v1",
            "signature_type": "Function"
        }
    ]
}