libxml streams use wrong content-type header when requesting… (CVE-2025-1219)

Summary

libxml streams use wrong content-type header when requesting a redirected resource

Original description

The description as published by the source.

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2025-1219 php7.4 Fixed in: 7.4.33-1+deb11u8

References

advisory github.com
advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web lists.debian.org