ALAS-2025-916

Amazon Linux 2023 Security Advisory: ALAS-2025-916
Advisory Release Date: 2025-03-26 20:44 Pacific
Advisory Updated Date: 2025-04-01 11:34 Pacific
Severity: Medium
Issue Overview:

Header parser of `http` stream wrapper does not handle folded headers. (CVE-2025-1217)

When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. (CVE-2025-1219)

Streams HTTP wrapper does not fail for headers with invalid name and no colon. (CVE-2025-1734)

Stream HTTP wrapper header check might omit basic auth header. (CVE-2025-1736)

Stream HTTP wrapper truncate redirect location to 1024 bytes (CVE-2025-1861)


Affected Packages:

php8.1


Issue Correction:
Run dnf update php8.1 --releasever 2023.7.20250331 to update your system.

New Packages:
aarch64:
    php8.1-soap-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pgsql-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-intl-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-cli-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pdo-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-common-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-mbstring-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-dbg-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-opcache-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-dbg-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-embedded-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-fpm-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-cli-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-embedded-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-common-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-fpm-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-intl-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-debugsource-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-devel-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pdo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-ffi-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pgsql-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-soap-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-mbstring-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-odbc-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-opcache-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-xml-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-xml-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-mysqlnd-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-mysqlnd-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-process-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-ffi-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-process-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-bcmath-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-ldap-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-dba-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-gd-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-zip-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-gmp-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-ldap-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-tidy-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-snmp-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-enchant-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pspell-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-odbc-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-gd-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-zip-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-snmp-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-tidy-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-dba-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-gmp-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-bcmath-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-pspell-debuginfo-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-8.1.32-1.amzn2023.0.1.aarch64
    php8.1-enchant-debuginfo-8.1.32-1.amzn2023.0.1.aarch64

src:
    php8.1-8.1.32-1.amzn2023.0.1.src

x86_64:
    php8.1-intl-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-cli-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-common-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pgsql-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pdo-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-opcache-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pdo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-common-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-intl-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-debugsource-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-xml-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-dbg-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-mysqlnd-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-embedded-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-soap-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-mbstring-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-opcache-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-cli-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-ldap-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-mbstring-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-fpm-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-mysqlnd-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-fpm-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-process-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-devel-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-ffi-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-embedded-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-xml-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pgsql-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-dbg-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-soap-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-odbc-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-gd-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-zip-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-snmp-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-ffi-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-tidy-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-dba-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-gmp-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-bcmath-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-process-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-gd-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-odbc-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-ldap-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-zip-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-gmp-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-bcmath-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-dba-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-tidy-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-snmp-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-enchant-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-enchant-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pspell-debuginfo-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-pspell-8.1.32-1.amzn2023.0.1.x86_64
    php8.1-8.1.32-1.amzn2023.0.1.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2025-1217, CVE-2025-1219, CVE-2025-1734, CVE-2025-1736, CVE-2025-1861

Mitre: CVE-2025-1217, CVE-2025-1219, CVE-2025-1734, CVE-2025-1736, CVE-2025-1861