CVE-2024-5458

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-5458
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-5458.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-5458
Aliases
Downstream
ALPINE (1)
ALSA (4)
AZL (2)
BELL (1)
CGA (4)
CLSA (6)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (5)
RLSA (4)
SUSE (4)
UBUNTU (1)
Related
ALSA (4)
openSUSE (1)
SUSE (4)
Published
2024-06-09T18:26:28Z
Modified
2026-07-17T21:00:20Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Filter bypass in filter_var (FILTER_VALIDATE_URL)
Details

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Database specific 
{
    "cna_assigner": "php",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5458.json"
}
References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type
GIT
Repo
https://github.com/php/php-src
Events
Introduced
c800ecda065b5642dde6aff5484d58d91d77f66c
Introduced
c6723538054d96291abb6bad4628b9f55bc7fc17
Introduced
a66aeecc2c0adc32ea0bbaa6e669b92f2deaa939
Introduced
381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115
Fixed
fc4973fb0dfae6085742868b8f0f05163e150a0c
Introduced
70ee6c20ad97e02c2b8098aeea96fefbbc3ac5c2
Fixed
40298a988fca728ddc47316938da61e0f768c872
Introduced
d26068059e83fe40de3430a512471d194119bee0
Fixed
ce51bfac759dedac1537f4d5666dcd33fbc4a281
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.3.27"
        },
        {
            "last_affected": "7.3.33"
        },
        {
            "introduced": "7.4.15"
        },
        {
            "last_affected": "7.4.33"
        },
        {
            "introduced": "8.0.2"
        },
        {
            "last_affected": "8.0.30"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.1.29"
        },
        {
            "introduced": "8.2.0"
        },
        {
            "fixed": "8.2.20"
        },
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.3.8"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-5458.json"