Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:77847
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.44 as permitted sender)
Message-ID: <5437CA24.3050608@gmail.Com>
Date: Fri, 10 Oct 2014 13:59:32 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.1.2
MIME-Version: 1.0
To: internals@lists.php.net, rdlowrey@php.net
References: <CAH8Mpn=qMkbBjDZRe-BX2Y0yQt_yR+y+Hu_gRHu=0jFTEV0MuA@mail.gmail.com> <54306D97.8050900@gmail.Com>
In-Reply-To: <54306D97.8050900@gmail.Com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17
From: jocelyn.fournier@gmail.com (jocelyn fournier)

Hi,

When do you plan to release a new 5.4.34 / 5.5.18 version with a fix for 
those issues ? I'm concerned because our app is just broken with this 
issue. Moreover 5.4.33 / 5.5.17 are used in some PHP Buildpack on PAAS 
platform like cloudfoundry/pivotal, they are directly affected by the 
problem.

Thanks !
   Jocelyn

Le 04/10/2014 23:58, jocelyn fournier a écrit :
> Hi,
>
> It would perhaps be great to communicate on this nasty bug on the PHP
> website ?
> For example code based on amqplib + ssl
> (https://github.com/videlalvaro/php-amqplib) is not working anymore as
> well, and it could be a headache to figure out why it's not working. I
> assume a lot more libs could be affected.
>
> Thanks,
>    Jocelyn
>
>
> Le 23/09/2014 07:39, Daniel Lowrey a écrit :
>>>> Hi,
>>>>
>>>> That's a bad thing we need to fix ASAP.
>>>>
>>>> I think for 5.6.1 we'll revert it , if not, we'll need an RC2, which
>>>> is something we usually don't do (but as this could involve security,
>>>> we may do it).
>>>> The fix can be merged to 5.5.18RC1, next week, to have an RC cycle if
>>>> not part of a 5.6.1RC2 (tag is tomorrow)
>>>>
>>>> 5.6 and 5.5 actually overlap in the release weeks. 5.6 is planned on
>>>> odd weeks whereas 5.5 is on even weeks.
>>>>
>>>> Waiting for Ferenc's advice anyway.
>>>>
>>>> Julien.P
>>>
>>> I have no issues with reverting at this point as that's the best
>>> route to
>>> get stable releases back on track. I thought I had fixed some really old
>>> bugs with those commits but the medicine turned out to be worse than the
>>> disease. My apologies again for letting those problems sneak into
>>> releases
>>> :/
>>
>> I've got the necessary fixes lined up at this point, I just need to know
>> how you guys would prefer to proceed on this.
>>
>> I can commit the relevant changes to 5.4, 5.5 and 5.6 and double-check
>> with
>> RMs to ensure they make it into this next set of releases or we can
>> revert
>> the previous commits and forget about the bug fixes altogether.
>>
>> Just let me know which you prefer. Thanks.
>>