Re: Heartbleed bug?

From	Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups	comp.lang.php
Subject	Re: Heartbleed bug?
Date	2014-04-10 07:53 -0400
Organization	A noiseless patient Spider
Message-ID	<li60oh$vd4$2@dont-email.me> (permalink)
References	(2 earlier) <VaadncnjeJs3zNjOnZ2dnUVZ_gmdnZ2d@giganews.com> <li3oid$2up$1@dont-email.me> <sL-dnfchC9A38NjOnZ2dnUVZ_tudnZ2d@giganews.com> <li40ir$8bs$2@dont-email.me> <bqlut8Fj6fnU1@mid.uni-berlin.de>

Show all headers | View raw

On 4/9/2014 6:11 PM, M. Strobel wrote:
> Am 09.04.2014 19:38, schrieb Jerry Stuckle:
>> On 4/9/2014 11:56 AM, Robert Heller wrote:
>>> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>
>>>>
>>>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>>>
>>>>>>
>>>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension
>>>>>>> is enabled? Is there a patch for the extension?
>>>>>>>
>>>>>>
>>>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>>>
>>>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>>>
>>>>>>
>>>>>
>>>>
>>>> That may or may not be.  It depends on exactly what the problem is - or
>>>> exactly what it affects.  From the description on the website, I can't
>>>> tell.  Can you?
>>>>
>>>> Obviously, though, those who know the code would know exactly what it
>>>> affects.
>>>>
>>>> A bug in a program does not necessarily affect everything that touches
>>>> that program!
>>>
>>> According to the CentOS mailing list, a patched version of the openssl
>>> libraries was released yesterday.  Only one version of CentOS (and I guess
>>> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
>>> also needs to remake certificates (with new private keys!) and revoke the old
>>> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
>>> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
>>> understanding that a *large* number of LAMP webservers are running some
>>> version of CentOS.  I presume that the system admins of the affected systems
>>> are on the CentOS mailing list and are on top of things.
>>>
>>>>
>>>>
>>>
>>
>> That may be.  But it still doesn't answer your original question as to how (or even
>> if) it affects PHP.
>>
>
> In german we call this "bug" a "GAU", that means "Maximum Credible Accident". You'd
> better *make sure* you are not affected. Starting point: you are.
>
> There seem to be "just a few versions" of openssl affected, but for those who are it
> is a GAU.
>
> /Str.
>

How do you know I am affected?  Do you know my code?  What PHP functions 
it affects?

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

Thread

Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
  Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
    Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
      Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
        Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
                Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
                Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
              Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
        Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
            Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
          Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
  Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
    Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
  Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
      Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
        Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
        Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
          Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
          Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
  Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200

csiph-web