5.3
Moyenne
CVE-2024-5458 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering…
Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| PHP 8.3 | premières → < 8.3.8 | 8.3.8 |
| PHP 8.2 | premières → < 8.2.20 | 8.2.20 |
| PHP 8.1 | premières → < 8.1.29 | 8.1.29 |
| PHP 8.3 | 8.3.0 → < 8.3.8 | 8.3.8 |
| PHP 8.2 | 8.2.0 → < 8.2.20 | 8.2.20 |
| PHP 8.1 | 8.1.0 → < 8.1.29 | 8.1.29 |
| PHP 8.0 | 8.0.2 → 8.0.30 | Pas de correctif indiqué |
| PHP 7.4 | 7.4.15 → 7.4.33 | Pas de correctif indiqué |
| PHP 7.3 | 7.3.27 → 7.3.33 | Pas de correctif indiqué |
Afficher l’autre branche Masquer l’autre branche
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| fedora | 40 | Pas de correctif indiqué |
Références
- github.com github.com
- www.openwall.com www.openwall.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de PHP
Les 103 CVE de PHP →
CVE-2026-109619
RCE via stale global state
9.2
Critique
CVE-2026-109618
RCE via OOM corruption
9.2
Critique
CVE-2026-92842
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a…
5.9
Moyenne
CVE-2026-91768
The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so…
6.5
Moyenne