[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: CVE Request: PHP v7 - Code execution vulnerability
From:       cve-assign () mitre ! org
Date:       2015-07-30 13:43:12
Message-ID: 20150730134312.B369E52E053 () smtpvbsrv1 ! mitre ! org
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

It seems possible that CVE IDs for issues affecting only PHP 7.0 would
be useful, but we wanted to send initial thoughts here before
proceeding.

The main concern is that all of the PHP 7.0 announcements have
specifically mentioned "THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT
IN PRODUCTION!" This is similar, but not identical, to the 'not
directly correspond to a "product"' factor mentioned at the end of the
http://openwall.com/lists/oss-security/2015/01/04/7 post.

One counterargument is that PHP 7.0, as far as we know, actually is
used in production at a very significant scale. We don't think that
oss-security would be an appropriate place for anyone to announce that
a major closed-source service is based on PHP 7.0. Maybe it's
sufficient to note that some web-hosting providers are advertising PHP
7.0 for general customer use (e.g., the
https://www.a2hosting.com/php-7-hosting page) or that there are
non-beta versions of open-source applications that only work with PHP
7.0 (we found https://github.com/composer/composer/issues/4090 but it
is not a real example).

Unless there is other information, we feel that CVE can include the
70140 issue, but that this doesn't mean that CVE should include every
bug fixed during 7.0 development, even if a security impact is
conceivable.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJVuilkAAoJEKllVAevmvmswVUH/1ZexDV4wPGHeja2rQxzItZ1
Ed1sXQNwVXHh89K9hVPJlEQXbj+4ECh83pNh7X5ubkbzAzdHR5miLL80L9dwgjYz
ubAzQ6NndSBlkFpL/EySgoTwXSyGFaZwcwNhx1h/uFtzHWrjWDFYebPMQ//IYIDv
ycyuhniDDKgq5QeF71W7zJp7fkBoY3TDeIV9HP4gOHXhuPM/lpOoCjZ7T30DJpPh
sth35QhtG6KbJX1X9KplcArNS3wChPDmMAb28WImSOEqfDT1JZh/YiQf4a/OPIER
q/PRCJ3u0HNtrfH7Rfj6NTfKa3e7lqXh8SwxYjegEvycjIe6oXU0ZCjDXGIgjBU=
=1jH2
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]