CVE-2024-5458: Filter bypass in filter_var (FILTER_VALIDATE_URL)
Filter bypass in filtervar (FILTERVALIDATEURL)
Other sources
Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filtervar FILTERVALIDATEURL). (CVE-2024-5458)
— PHP
In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, due to a code logic error, filtering functions such as filtervar when validating URLs (FILTERVALIDATEURL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php8.2to a version that resolves this vulnerability.Fixed in 8.2.20-1~deb12u1Fixed in 8.2.23-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 8.2.20 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.1.29 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.2.20 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 8.3.8 - Upgrade
Upgrade
php/php-srcto a version that resolves this vulnerability.Fixed in 8.1.29Patch GHSA-w8qr-v226-r27w - Upgrade
Upgrade
php/php-srcto a version that resolves this vulnerability.Fixed in 8.2.20Patch GHSA-w8qr-v226-r27w - Upgrade
Upgrade
php/php-srcto a version that resolves this vulnerability.Fixed in 8.3.8Patch GHSA-w8qr-v226-r27w
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5458?
CVE-2024-5458 has a high severity due to the potential for filter bypass vulnerabilities in PHP's URL validation.
Who is affected by CVE-2024-5458?
CVE-2024-5458 affects PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8.
How do I fix CVE-2024-5458?
To fix CVE-2024-5458, upgrade to PHP version 8.1.29, 8.2.20, or 8.3.8 or later.
What type of vulnerability is CVE-2024-5458?
CVE-2024-5458 is a filter bypass vulnerability related to URL validation functions in PHP.
Is there a workaround for CVE-2024-5458?
There is no official workaround for CVE-2024-5458; the recommended action is to update to a secure version.