Описание
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Отчет
This flaw in PHP's filter_var function with FILTER_VALIDATE_URL constitutes a moderate severity issue because, while it allows URLs with invalid user information to be treated as valid, it does not directly facilitate immediate security breaches or exploits on its own. The impact is limited to cases where applications rely solely on this function for URL validation without additional checks, potentially leading to improper handling of user credentials. However, the flaw does not compromise the overall integrity of the PHP interpreter, nor does it inherently lead to data corruption or system crashes. Its exploitation requires specific conditions and contexts, making it less critical than high-severity vulnerabilities that enable direct remote code execution or privilege escalation.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | php | Not affected | ||
| Red Hat Enterprise Linux 6 | php | Out of support scope | ||
| Red Hat Enterprise Linux 7 | php | Out of support scope | ||
| Red Hat Enterprise Linux 8 | php:8.0/php | Will not fix | ||
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2024:10951 | 11.12.2024 |
| Red Hat Enterprise Linux 8 | php | Fixed | RHSA-2024:10952 | 11.12.2024 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2024:10949 | 11.12.2024 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2024:10950 | 11.12.2024 |
| Red Hat Enterprise Linux 9 | php | Fixed | RHSA-2025:7315 | 13.05.2025 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
In PHP versions8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before ...
EPSS
5.3 Medium
CVSS3