[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Jul 2015 09:43:12 -0400 (EDT)
From: cve-assign@...re.org
To: fourny.d@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: PHP v7 - Code execution vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
It seems possible that CVE IDs for issues affecting only PHP 7.0 would
be useful, but we wanted to send initial thoughts here before
proceeding.
The main concern is that all of the PHP 7.0 announcements have
specifically mentioned "THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT
IN PRODUCTION!" This is similar, but not identical, to the 'not
directly correspond to a "product"' factor mentioned at the end of the
http://openwall.com/lists/oss-security/2015/01/04/7 post.
One counterargument is that PHP 7.0, as far as we know, actually is
used in production at a very significant scale. We don't think that
oss-security would be an appropriate place for anyone to announce that
a major closed-source service is based on PHP 7.0. Maybe it's
sufficient to note that some web-hosting providers are advertising PHP
7.0 for general customer use (e.g., the
https://www.a2hosting.com/php-7-hosting page) or that there are
non-beta versions of open-source applications that only work with PHP
7.0 (we found https://github.com/composer/composer/issues/4090 but it
is not a real example).
Unless there is other information, we feel that CVE can include the
70140 issue, but that this doesn't mean that CVE should include every
bug fixed during 7.0 development, even if a security impact is
conceivable.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJVuilkAAoJEKllVAevmvmswVUH/1ZexDV4wPGHeja2rQxzItZ1
Ed1sXQNwVXHh89K9hVPJlEQXbj+4ECh83pNh7X5ubkbzAzdHR5miLL80L9dwgjYz
ubAzQ6NndSBlkFpL/EySgoTwXSyGFaZwcwNhx1h/uFtzHWrjWDFYebPMQ//IYIDv
ycyuhniDDKgq5QeF71W7zJp7fkBoY3TDeIV9HP4gOHXhuPM/lpOoCjZ7T30DJpPh
sth35QhtG6KbJX1X9KplcArNS3wChPDmMAb28WImSOEqfDT1JZh/YiQf4a/OPIER
q/PRCJ3u0HNtrfH7Rfj6NTfKa3e7lqXh8SwxYjegEvycjIe6oXU0ZCjDXGIgjBU=
=1jH2
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
