CVE-2025-1735
pgsql extension does not check for errors during escaping
Summary
pgsql extension does not check for errors during escaping
Original description
The description as published by the source.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
libphp
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php-min
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Bitnami
php
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.1.33"},{"introduced":"8.2.0"},{"fixed":"8.2.29"},{"introduced":"8.3.0"},{"fixed":"8.3.23"},{"introduced":"8.4.0"},{"fixed":"8.4.10"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-1735 php7.4 Fixed in: 7.4.33-1+deb11u9
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web openwall.com
- web lists.debian.org