Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73248
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.179 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPhkiZyxdbb-yne9ZV-+-kaaR5ap8rbxTNAqcoz40YFdNhgDoQ@mail.gmail.com>
References: <CAPhkiZzAxQnQpWOh7xhAM4h3r7xCYjD_P3d9mWmDX4Sr0Qc9Ng@mail.gmail.com>
 <CAGa2bXZHYJzcV2E-SDN7-u1_SLrW8Tr7hwkQG5JSnD-7oh-Xvg@mail.gmail.com>
 <CAPhkiZzRZSRH3LWQqL=mik1KJ8i=19QNatFPoK7TXZMru5SKZA@mail.gmail.com>
 <CAGa2bXaGRk0PipbF_DYSgcPNwLvs=8nb8yHG9XFawrNFUVmdyQ@mail.gmail.com>
 <CAEZPtU5=1ZL8sn+YZqKOdfGi8zthuMu3YgkVaecY+v3Hfo7Mfg@mail.gmail.com> <CAPhkiZyxdbb-yne9ZV-+-kaaR5ap8rbxTNAqcoz40YFdNhgDoQ@mail.gmail.com>
Date: Tue, 18 Mar 2014 07:07:08 +0900
Message-ID: <CAGa2bXZM3_MByBZwWXbMe9MdAmjUyKHz6jD+gVDKwSKUvvXHBg@mail.gmail.com>
To: Andrey Andreev <narf@devilix.net>
Cc: Pierre Joye <pierre.php@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11349f4c5d520d04f4d4a6a9
Subject: Re: [PHP-DEV] Session: deprecating create_sid() method and add createSid()?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11349f4c5d520d04f4d4a6a9
Content-Type: text/plain; charset=UTF-8

Hi Andrey,

On Tue, Mar 18, 2014 at 6:59 AM, Andrey Andreev <narf@devilix.net> wrote:

> On Mon, Mar 17, 2014 at 11:15 PM, Pierre Joye <pierre.php@gmail.com>
> wrote:
> > hi,
> >
> > On Mon, Mar 17, 2014 at 10:09 PM, Yasuo Ohgaki <yohgaki@ohgaki.net>
> wrote:
> >
> > For one, I appreciate the effort that both of you put on the session
> management.
> >
> > It seems that you are somehow alone to discuss this issue and slightly
> > in circle right now.
> >
> > I would suggest two steps:
> >
> > - sit down together for a chat and get your stuff together. It will by
> > far more efficient than mails
> >
> > - write one or more RFCs to fix what should be fixed, how and why (see
> > next point :)
> >
> > - provide more info about the actual critical security impact that
> > could be fixed by the changes
> >   as of now, I failed to see any CVE related to what you are referring to
>
> We'll surely do that.
> In fact, I was just about to write Yasuo a private mail about some
> security issues, because I didn't find an option to report a bug and
> make it hidden. Is there such an option, or does the CVE assignment
> process allow that? (I'm not familiar with it)


Getting CVE is easy. One just have to describe what the vulnerability is and
send request mail to MITRE. If personnel in MITRE agrees it as new
vulnerability,
then they give us new CVE, if not, they give us existing CVE.

I don't think this (session_regenerate_id() issue) is PHP's CVE issue as it
may
be avoided by user land like timing attack issue.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11349f4c5d520d04f4d4a6a9--