CVE-2025-1220

Null byte termination in hostnames

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami libphp

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]

Bitnami php-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]

Bitnami php

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2025-1220 php7.4 Corrigé dans: 7.4.33-1+deb11u9

Références

advisory github.com
advisory nvd.nist.gov
advisory github.com
web openwall.com
web lists.debian.org

Métadonnées

CVE: CVE-2025-1220
GHSA: GHSA-3cr5-j632-f35r
Publication: 2025-07-13
Première détection SecPulse: il y a 1 an
Source initiale: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-918

Sources de détection

OSV.dev (Open Source Vulnerabilities) il y a 2 mois