Date: Thu, 30 Jul 2015 09:43:12 -0400 (EDT) From: cve-assign@...re.org To: fourny.d@...il.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: PHP v7 - Code execution vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 It seems possible that CVE IDs for issues affecting only PHP 7.0 would be useful, but we wanted to send initial thoughts here before proceeding. The main concern is that all of the PHP 7.0 announcements have specifically mentioned "THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION!" This is similar, but not identical, to the 'not directly correspond to a "product"' factor mentioned at the end of the http://openwall.com/lists/oss-security/2015/01/04/7 post. One counterargument is that PHP 7.0, as far as we know, actually is used in production at a very significant scale. We don't think that oss-security would be an appropriate place for anyone to announce that a major closed-source service is based on PHP 7.0. Maybe it's sufficient to note that some web-hosting providers are advertising PHP 7.0 for general customer use (e.g., the https://www.a2hosting.com/php-7-hosting page) or that there are non-beta versions of open-source applications that only work with PHP 7.0 (we found https://github.com/composer/composer/issues/4090 but it is not a real example). Unless there is other information, we feel that CVE can include the 70140 issue, but that this doesn't mean that CVE should include every bug fixed during 7.0 development, even if a security impact is conceivable. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJVuilkAAoJEKllVAevmvmswVUH/1ZexDV4wPGHeja2rQxzItZ1 Ed1sXQNwVXHh89K9hVPJlEQXbj+4ECh83pNh7X5ubkbzAzdHR5miLL80L9dwgjYz ubAzQ6NndSBlkFpL/EySgoTwXSyGFaZwcwNhx1h/uFtzHWrjWDFYebPMQ//IYIDv ycyuhniDDKgq5QeF71W7zJp7fkBoY3TDeIV9HP4gOHXhuPM/lpOoCjZ7T30DJpPh sth35QhtG6KbJX1X9KplcArNS3wChPDmMAb28WImSOEqfDT1JZh/YiQf4a/OPIER q/PRCJ3u0HNtrfH7Rfj6NTfKa3e7lqXh8SwxYjegEvycjIe6oXU0ZCjDXGIgjBU= =1jH2 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ