Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101117
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 209.85.220.182 as permitted sender)
MIME-Version: 1.0
Sender: php@golemon.com
In-Reply-To: <CAF+90c9pQ_mvG30T81LYYhH9o4rJqC_FhJndHsGK_m9SDo4BgQ@mail.gmail.com>
References: <CAESVnVodb3=ANb-5ZY5p5_SpLsbE7JQJ7+BEzmX-A8U=TbBYnw@mail.gmail.com>
 <eabb8265-c82b-16da-82af-e9d9669fe7ac@cubiclesoft.com> <CAML1Pf7_WZJOo3Hma7Qdi3wztoi6RNw_C-YmNRJaL54r7n5SjA@mail.gmail.com>
 <CAF+90c9pQ_mvG30T81LYYhH9o4rJqC_FhJndHsGK_m9SDo4BgQ@mail.gmail.com>
Date: Thu, 9 Nov 2017 16:50:25 -0500
Message-ID: <CAESVnVoq_OSUjz+o5aFmrh8=dq5g1CB6d10EK3dDyb7FBu55vQ@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: Giovanni Giacobbi <giovanni@giacobbi.net>, Thomas Hruska <thruska@cubiclesoft.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] PHP 7.2.0 RC6 Released
From: pollita@php.net (Sara Golemon)

On Thu, Nov 9, 2017 at 2:25 PM, Nikita Popov <nikita.ppv@gmail.com> wrote:
>> This is utterly disappointing considering that bug #73535 is marked as
>> private and I couldn't easily gather more information about this bug on
>> google. Since I have the feeling this is an open secret can you disclose
>> more information and proposed patches so that sysadmins can assess by
>> themselves the risks, mitigation techniques, and whether to patch their
>> own
>> installations?
>>
>> I guess the dev team wouldn't leave us with our pants down, so I expect
>> this to of difficult exploitability. Anyway, after a year it's time for
>> full disclosure, don't you think?
>
>
> So as to avoid unnecessary fearmongering, this refers to a denial-of-service
> vulnerability requiring specific application code. If your code implements a
> certain operation in a specific way, it may be possible to make it go into
> an infinite loop based on remote interaction. Apart from the increased
> server load, this is not dangerous. (Of course, if someone is actively using
> this against you, you'd notice...)
>
Agree with Niki that this isn't going to be commonly exploitable, and
has likely existed for a significant range of versions.  Given that,
I'm going to say it probably won't (by itself) merit pushing back GA
at this stage.  That said, it should be addressed sooner rather than
later as it looks like we're not surfacing good information to
userspace under these circumstances.

-Sara