Critical Security Update for php-pecl Packages: Addressing Multiple Vulnerabilities
Summary
RLSA-2025:7418: Important: php:8.3 security update. Affects php-pecl-apcu versions < 0:5.1.23-1.module+el9.5.0+29598+58484504. Fixed in 0:5.1.23-1.module+el9.5.0+29598+58484504. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used HTML-embedded scripting language, primarily utilized in conjunction with the Apache HTTP Server. The php-pecl packages, including php-pecl-apcu, php-pecl-rrd, and php-pecl-zip, extend PHP's functionality with additional features. These packages are essential for developers who require advanced caching, data visualization, and file compression capabilities. However, recent vulnerabilities have been identified that could compromise the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities stem from various issues within the PHP stream wrapper and header parsing mechanisms. Notably, the header parser does not correctly handle folded headers, which can lead to unexpected behavior. Additionally, the HTTP wrapper may omit basic authentication headers, fail to reject headers with invalid names, and incorrectly manage content-type headers during resource redirection. These flaws could allow attackers to exploit the system, leading to unauthorized access, data leakage, or application crashes. The CVSS score for these vulnerabilities is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0:5.1.23-1.module+el9.5.0+29598+58484504
This is the first release that contains the fix.
sudo dnf update php-pecl-apcuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the affected features of the php-pecl packages until the updates can be applied. This may involve modifying the PHP configuration files to prevent the use of the stream wrapper functionalities that are vulnerable.
Conclusion
In summary, the php-pecl packages have been found to contain critical vulnerabilities that require immediate attention. Updating to the patched versions is essential to maintain the security of applications using these packages. Utilizing tools like Vulert can aid in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for php-pecl-apcu →
FAQ
The vulnerabilities include improper handling of folded headers, omission of basic auth headers, failure to reject invalid headers, incorrect content-type management, and issues with redirect location truncation.
The vulnerabilities have a CVSS score of 8.1, indicating a high severity level that could lead to significant security risks if not addressed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file, you can check for vulnerabilities without needing to access the code.
If immediate updates are not possible, consider disabling the affected features in your PHP configuration as a temporary workaround until the updates can be applied.
For detailed information about the vulnerabilities, including CVE references and security fixes, refer to the official advisory RLSA-2025:7418.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-pecl-apcu.
