ALAS-2025-922

Amazon Linux 2023 Security Advisory: ALAS-2025-922
Advisory Release Date: 2025-03-26 20:44 Pacific
Advisory Updated Date: 2025-04-01 11:34 Pacific
Severity: Important
Issue Overview:

NOTE:
https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477
https://www.tenable.com/cve/CVE-2024-11235

Version
This vulnerability is present only in PHP 8.3+. The PHP 8.2 and versions before are not impacted.() (CVE-2024-11235)

Header parser of `http` stream wrapper does not handle folded headers. (CVE-2025-1217)

When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. (CVE-2025-1219)

Streams HTTP wrapper does not fail for headers with invalid name and no colon. (CVE-2025-1734)

Stream HTTP wrapper header check might omit basic auth header. (CVE-2025-1736)

Stream HTTP wrapper truncate redirect location to 1024 bytes (CVE-2025-1861)


Affected Packages:

php8.3


Issue Correction:
Run dnf update php8.3 --releasever 2023.7.20250331 to update your system.

New Packages:
aarch64:
    php8.3-common-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-mysqlnd-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-opcache-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-intl-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-soap-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-dbg-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-xml-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-embedded-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-cli-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-embedded-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-modphp-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-mbstring-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-opcache-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-debugsource-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pdo-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-intl-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-mbstring-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pdo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-cli-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pgsql-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-devel-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-modphp-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-mysqlnd-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pgsql-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-common-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-fpm-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-dbg-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-process-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-fpm-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-ffi-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-xml-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-odbc-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-soap-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-ffi-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-process-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-zip-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-sodium-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-bcmath-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-ldap-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-odbc-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-gd-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-sodium-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-dba-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-zip-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-ldap-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-gmp-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-tidy-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-snmp-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-enchant-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pspell-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-snmp-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-gd-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-dba-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-tidy-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-gmp-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-bcmath-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-enchant-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-pspell-debuginfo-8.3.19-1.amzn2023.0.1.aarch64
    php8.3-8.3.19-1.amzn2023.0.1.aarch64

src:
    php8.3-8.3.19-1.amzn2023.0.1.src

x86_64:
    php8.3-embedded-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-mysqlnd-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-common-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-cli-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pgsql-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-dbg-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-fpm-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-modphp-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-opcache-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-devel-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-debugsource-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-dbg-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-opcache-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-intl-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pdo-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-ffi-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-process-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-zip-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-modphp-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-mbstring-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-soap-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-mbstring-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-xml-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-intl-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-cli-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-soap-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-xml-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-fpm-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-mysqlnd-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-common-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-embedded-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pdo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-sodium-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-ldap-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-odbc-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pgsql-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-snmp-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-gd-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-ffi-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-dba-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-tidy-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-gmp-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-bcmath-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-process-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-odbc-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-sodium-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-gd-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-zip-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-ldap-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-gmp-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-bcmath-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-dba-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-snmp-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-tidy-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-enchant-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pspell-debuginfo-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-enchant-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-pspell-8.3.19-1.amzn2023.0.1.x86_64
    php8.3-8.3.19-1.amzn2023.0.1.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2024-11235, CVE-2025-1217, CVE-2025-1219, CVE-2025-1734, CVE-2025-1736, CVE-2025-1861

Mitre: CVE-2024-11235, CVE-2025-1217, CVE-2025-1219, CVE-2025-1734, CVE-2025-1736, CVE-2025-1861