libxml streams use wrong content-type header when requesting… (CVE-2025-1219)

Résumé

libxml streams use wrong content-type header when requesting a redirected resource

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2025-1219 php7.4 Corrigé dans: 7.4.33-1+deb11u8

Références

advisory github.com
advisory nvd.nist.gov
advisory security.netapp.com
advisory github.com
web lists.debian.org