Detections
Analytics
Alpine: multiple php82 packages: security update to 8.2.29-r0
medium Tenable Cloud Security Plugin ID 428275
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some
functions like fsockopen() lack validation that the hostname supplied does not contain null characters.
This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to
security problems if the user code implements access checks before access using such functions.
(CVE-2025-1220)
- In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql
escaping functions do not check if the underlying quoting functions returned errors. This could cause
crashes if Postgres server rejects the string as invalid. (CVE-2025-1735)
- In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when
parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer
dereference. This may lead to crashes and affect the availability of the target server. (CVE-2025-6491)
See Also
https://security.alpinelinux.org/vuln/CVE-2025-1220
Plugin Details
Severity: Medium
ID: 428275
Version: Revision 1.8
Type: Local
Published: 7/2/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2025-1220
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available