Alma Linux: CVE-2024-5458: Moderate: php:8.2 security update (Multiple Advisories)

Alma Linux: CVE-2024-5458: Moderate: php:8.2 security update (Multiple Advisories)

Severity

5

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

06/09/2024

Created

12/20/2024

Added

12/19/2024

Modified

01/28/2025

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

Solution(s)

• alma-upgrade-apcu-panel
• alma-upgrade-libzip
• alma-upgrade-libzip-devel
• alma-upgrade-libzip-tools
• alma-upgrade-php
• alma-upgrade-php-bcmath
• alma-upgrade-php-cli
• alma-upgrade-php-common
• alma-upgrade-php-dba
• alma-upgrade-php-dbg
• alma-upgrade-php-devel
• alma-upgrade-php-embedded
• alma-upgrade-php-enchant
• alma-upgrade-php-ffi
• alma-upgrade-php-fpm
• alma-upgrade-php-gd
• alma-upgrade-php-gmp
• alma-upgrade-php-intl
• alma-upgrade-php-json
• alma-upgrade-php-ldap
• alma-upgrade-php-mbstring
• alma-upgrade-php-mysqlnd
• alma-upgrade-php-odbc
• alma-upgrade-php-opcache
• alma-upgrade-php-pdo
• alma-upgrade-php-pear
• alma-upgrade-php-pecl-apcu
• alma-upgrade-php-pecl-apcu-devel
• alma-upgrade-php-pecl-rrd
• alma-upgrade-php-pecl-xdebug
• alma-upgrade-php-pecl-xdebug3
• alma-upgrade-php-pecl-zip
• alma-upgrade-php-pgsql
• alma-upgrade-php-process
• alma-upgrade-php-snmp
• alma-upgrade-php-soap
• alma-upgrade-php-xml
• alma-upgrade-php-xmlrpc

References

• https://attackerkb.com/topics/cve-2024-5458
• CVE - 2024-5458
• https://errata.almalinux.org/8/ALSA-2024-10951.html
• https://errata.almalinux.org/8/ALSA-2024-10952.html
• https://errata.almalinux.org/9/ALSA-2024-10949.html
• https://errata.almalinux.org/9/ALSA-2024-10950.html