Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #13386
| From | Eli the Bearded <*@eli.users.panix.com> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: Heartbleed bug? |
| Date | 2014-04-11 00:38 +0000 |
| Organization | Some absurd concept |
| Message-ID | <eli$1404102016@qz.little-neck.ny.us> (permalink) |
| References | <38941292-a3a7-4dc0-ba31-873351d81924@googlegroups.com> <53468885$0$6603$9b4e6d93@newsspool4.arcor-online.net> <li77rq$6qp$2@dont-email.me> <li7ai6$htq$2@news.albasani.net> |
In comp.lang.php, The Natural Philosopher <tnp@invalid.invalid> wrote:
> On 11/04/14 00:01, Denis McMahon wrote:
> > As far as I can tell, PHP does not "use" OpenSSL directly itself, unless
> > a person writing php scripts calls functions that do use OpenSSL, and it
> > only seems to be when those functions are used that the vulnerability can
> > be exploited.
You can, however, use OpenSSL in PHP without calling any functions that
have "ssl" in the name.
> > For example, the following php script as a web page has no exposure to
> > the OpenSSL vulnerability:
> >
> > <?php
> > echo "<!doctype html><html lang='en'><head><title>Test</title></
> > head><body><h1>Hello World</h1></body></html>"
> > ?>
> ER, it COULD if it was running on a secure server!!!
No, that script would not. Or maybe it will make more sense like this:
"ER, that script WOULD NOT!!!1111"
In your scenario, the server (eg, Apache) has an OpenSSL
vulnerability, not the PHP component. On some of my servers OpenSSL
is being used by PHP because I am using the curl module to interact
with an SSL server. I suspect PHP can use OpenSSL for
fopen("https://...") type constructs, too. I'm not sure I've ever
tried fopen() with https.
From "grep -i ssl configure", it looks like OpenSSL is the only SSL
library that PHP (4.4.x, 5.4.x) will attempt to use. Apparently is/can
be used by the Kerberos and imap functions, too.
From "grep -i ssl configure", Apache (2.2.x) can use OpenSSL or RSA SSL-C.
Elijah
------
or you could terminate ssl on the load balancer and not in the server at all
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200
csiph-web