Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73249
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain devilix.net designates 209.85.160.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZM3_MByBZwWXbMe9MdAmjUyKHz6jD+gVDKwSKUvvXHBg@mail.gmail.com>
References: <CAPhkiZzAxQnQpWOh7xhAM4h3r7xCYjD_P3d9mWmDX4Sr0Qc9Ng@mail.gmail.com>
	<CAGa2bXZHYJzcV2E-SDN7-u1_SLrW8Tr7hwkQG5JSnD-7oh-Xvg@mail.gmail.com>
	<CAPhkiZzRZSRH3LWQqL=mik1KJ8i=19QNatFPoK7TXZMru5SKZA@mail.gmail.com>
	<CAGa2bXaGRk0PipbF_DYSgcPNwLvs=8nb8yHG9XFawrNFUVmdyQ@mail.gmail.com>
	<CAEZPtU5=1ZL8sn+YZqKOdfGi8zthuMu3YgkVaecY+v3Hfo7Mfg@mail.gmail.com>
	<CAPhkiZyxdbb-yne9ZV-+-kaaR5ap8rbxTNAqcoz40YFdNhgDoQ@mail.gmail.com>
	<CAGa2bXZM3_MByBZwWXbMe9MdAmjUyKHz6jD+gVDKwSKUvvXHBg@mail.gmail.com>
Date: Tue, 18 Mar 2014 00:20:48 +0200
Message-ID: <CAPhkiZx5U2Ew7h6gb+X-KeU01n9YK+qky6FA9Pj8ctrsK0hRag@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Pierre Joye <pierre.php@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Session: deprecating create_sid() method and add createSid()?
From: narf@devilix.net (Andrey Andreev)

Hi,

On Tue, Mar 18, 2014 at 12:07 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Getting CVE is easy. One just have to describe what the vulnerability is and
> send request mail to MITRE. If personnel in MITRE agrees it as new
> vulnerability,
> then they give us new CVE, if not, they give us existing CVE.
>
> I don't think this (session_regenerate_id() issue) is PHP's CVE issue as it
> may
> be avoided by user land like timing attack issue.

No, I'm not talking about session_regenerate_id() ... sorry that I
mentioned it in this thread. I'd rather not share that publicly until
it's resolved, and hence why my question was - can CVEs be hidden
until that happens?

Cheers,
Andrey.