CVE-2025-1734
Streams HTTP wrapper does not fail for headers with invalid name and no colon
概要
Streams HTTP wrapper does not fail for headers with invalid name and no colon
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.32"},{"introduced":"8.2.0"},{"fixed":"8.2.28"},{"introduced":"8.3.0"},{"fixed":"8.3.19"},{"introduced":"8.4.0"},{"fixed":"8.4.5"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-1734 php7.4 修正版: 7.4.33-1+deb11u8
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory github.com
- web lists.debian.org