php5: FILTER_VALIDATE_URL will invalidate a hostname that includes '-'

[Sven 'Darkman' Michels]

Binary package hint: php5

Hi,

there is a bug in php 5.3.2 which makes filter_var to fail on urls/domains/hosts that contain a dash ('-').

Since filter_var is used in some well known webfrontends (syscp for example), the bug stops users from using domains like "ubuntu-linux.org".

The patch is included in php 5.3.3.

More can be found here: http://bugs.php.net/bug.php?id=51192

Regards,
Sven

[Ondřej Surý (ondrej)]

BTW This bug is security and has assigned CVE: http://security-tracker.debian.org/tracker/CVE-2010-3710

[Adam Harvey (lawngnome)]

That CVE is actually for a different filter bug, namely http://bugs.php.net/52929. You'll probably want to backport that fix as well, but they're separate issues.

[Ondřej Surý (ondrej)]

Adam, you're right. This affects only lucid php5. And as I have suggested in 685014, it seems to be a good idea to pick the fixes from 5.3.3-6 to maverick and now it seems to be a good idea to pick them also for 5.3.2 (plus all other segfault bugs which can be found in upstream SVN).

[Chuck Short (zulcss)]

Hi,

This is fixed in natty. Thanks for the bug report.

Regards
chuck

[Steve Beattie (sbeattie)]

Removing the reference to CVE-2010-3710; that was fixed in USN 1042-1 (http://www.ubuntu.com/usn/usn-1042-1) and is a separate issue anyway.

[Olivier Dobberkau (olivier-dobberkau)]

Hi Guys, any update on this for lucid? We experience this bug in TYPO3. Thanks, Olivier

[Ingo Renner (ingo-typo3)]

will there be progress here? This is quite an annoying issue as it affects a lot of websites and php frameworks...

[Jordan Hagan (ephess)]

I've backported the fix - just working on getting it tested now... shouldn't be too long

[Ingo Renner (ingo-typo3)]

thanks for letting us know!

[Jordan Hagan (ephess)]

Fix is tested and backported.. waiting on change to be reviewed and approved =)

[Scott Moser (smoser)]

I've marked this as fix-released as it is reported to be fixed in natty. And then nominated it for Lucid.

[Jordan Hagan (ephess)]

Debdiff attached =) Hopefully this will work.

[Olivier Dobberkau (olivier-dobberkau)]

Hi. Any news on this? Can we foresee a release date yet? Many thanks!

[Jordan Hagan (ephess)]

Updated debdiff attached:

[Jordan Hagan (ephess)]

Updated debdiff attached:

[Olivier Dobberkau (olivier-dobberkau)]

FYI: I have created a ppa with the patch from Jordan here: https://launchpad.net/~olivier-dobberkau/+archive/ppa/+packages
Patch works.

[Olivier Dobberkau (olivier-dobberkau)]

Just a question. Cant find the any mention in Ubuntu Security Notice USN-1231-1 if this bug was fixed too.
Any info on that. this Bug is really annoying. thanks!

[Olivier Dobberkau (olivier-dobberkau)]

Hi. This is a kind reminder on this Bug. it is a nobrainer. please take the patch and commit it... thank you!

[Olivier Dobberkau (olivier-dobberkau)]

Dear Santa.
Please inspire the Guys in charge here to include this tiny patch in the next fix!
Thank you! ;-)

[Olivier Dobberkau (olivier-dobberkau)]

Hi Scott,

can have a look at this one please?
Looks like this is a simple fix and it could be added to the next release of php5 on lucid.

Thanks! Olivier.

[Guy Van Sanden (gvs)]

Won't this be fixed for Lucid? It's pretty annoying and there's no other fix than upgrading to 12.04?

[Olivier Dobberkau (olivier-dobberkau)]

I maintain a private ppa with this fix..

https://launchpad.net/~olivier-dobberkau/+archive/php5-usn-1437-1

i try to stay uptodate with the current security patches in lucid php5.

the patch it self is a no brainer!

[Andreas Otto (andreas-otto)]

What is the status of this bug?

Will this ever be fixed for 10.04 LTS?

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Olivier Dobberkau (olivier-dobberkau)]

Lets hope that the next no-brainer with patch does not gets the same treatment.
this really weakens my perception of ubuntu LTS: :-(

[Sven 'Darkman' Michels (sven+launchpad)]

Yeah, hopefully. I mean, a patch exists, its no big change, and 5 years nothing. This is not what i thought that LTS is about....