Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101116
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAML1Pf7_WZJOo3Hma7Qdi3wztoi6RNw_C-YmNRJaL54r7n5SjA@mail.gmail.com>
References: <CAESVnVodb3=ANb-5ZY5p5_SpLsbE7JQJ7+BEzmX-A8U=TbBYnw@mail.gmail.com>
 <eabb8265-c82b-16da-82af-e9d9669fe7ac@cubiclesoft.com> <CAML1Pf7_WZJOo3Hma7Qdi3wztoi6RNw_C-YmNRJaL54r7n5SjA@mail.gmail.com>
Date: Thu, 9 Nov 2017 20:25:15 +0100
Message-ID: <CAF+90c9pQ_mvG30T81LYYhH9o4rJqC_FhJndHsGK_m9SDo4BgQ@mail.gmail.com>
To: Giovanni Giacobbi <giovanni@giacobbi.net>
Cc: Thomas Hruska <thruska@cubiclesoft.com>, Sara Golemon <pollita@php.net>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="001a113f2c24879d99055d91c3e6"
Subject: Re: [PHP-DEV] PHP 7.2.0 RC6 Released
From: nikita.ppv@gmail.com (Nikita Popov)

--001a113f2c24879d99055d91c3e6
Content-Type: text/plain; charset="UTF-8"

On Thu, Nov 9, 2017 at 7:07 PM, Giovanni Giacobbi <giovanni@giacobbi.net>
wrote:

> On 9 November 2017 at 18:46, Thomas Hruska <thruska@cubiclesoft.com>
> wrote:
>
> > On 11/9/2017 7:36 AM, Sara Golemon wrote:
> >
> >> The sixth (and likely final) release candidate for 7.2.0 was just
> >> released and can be
> >> downloaded from:
> >> https://downloads.php.net/~pollita/
> >> Or using the git tag: php-7.2.0RC6
> >>
> >> Barring unforeseen calamity, everyone should expect 7.2.0-final on
> >> Thursday, November 30th.
> >>
> >
> > Issue #73535?  I consider letting a known security vulnerability that
> goes
> > largely unaddressed but persists into the next major version of a
> software
> > product to be quantifiable as a calamity of sorts.  It's fast
> approaching a
> > full year without any resolution in sight.  Many people would have zero
> > day-ed the issue by this point at whatever conferences have come and gone
> > (Black Hat, DEF CON, etc.) to grab some quick notoriety.  I don't believe
> > that zero day-ing a vulnerability on a stage is the right solution for a
> > garden variety of reasons.
> >
> >
> This is utterly disappointing considering that bug #73535 is marked as
> private and I couldn't easily gather more information about this bug on
> google. Since I have the feeling this is an open secret can you disclose
> more information and proposed patches so that sysadmins can assess by
> themselves the risks, mitigation techniques, and whether to patch their own
> installations?
>
> I guess the dev team wouldn't leave us with our pants down, so I expect
> this to of difficult exploitability. Anyway, after a year it's time for
> full disclosure, don't you think?
>

So as to avoid unnecessary fearmongering, this refers to a
denial-of-service vulnerability requiring specific application code. If
your code implements a certain operation in a specific way, it may be
possible to make it go into an infinite loop based on remote interaction.
Apart from the increased server load, this is not dangerous. (Of course, if
someone is actively using this against you, you'd notice...)

Nikita

--001a113f2c24879d99055d91c3e6--