Skip to content
OpenAdvisories
Medium USN-6841-1 1 CVE

php7.4, php8.1, php8.2, php8.3 vulnerability

Published Jun 19, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP could early return in the filter_var function
resulting in invalid user information being treated as valid user
information. An attacker could possibly use this issue to expose raw
user input information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS php7.4 7.4.3-4ubuntu2.23
Ubuntu · 22.04 LTS 22.04:LTS php8.1 8.1.2-1ubuntu2.18
Ubuntu · 24.04 LTS 24.04:LTS php8.3 8.3.6-0ubuntu0.24.04.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-5458 EPSS 12%

    Filter bypass in filter_var (FILTER_VALIDATE_URL)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user infor…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-5458