Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5972 > unrolled thread
| Started by | Radoslav Bodó <bodik@cesnet.cz> |
|---|---|
| First post | 2021-10-08 11:30 +0200 |
| Last post | 2021-10-09 19:50 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.security
FYI php disable_function bypass bug Radoslav Bodó <bodik@cesnet.cz> - 2021-10-08 11:30 +0200
Re: FYI php disable_function bypass bug Sylvain Beucler <beuc@beuc.net> - 2021-10-09 19:50 +0200
| From | Radoslav Bodó <bodik@cesnet.cz> |
|---|---|
| Date | 2021-10-08 11:30 +0200 |
| Subject | FYI php disable_function bypass bug |
| Message-ID | <D5U37-uF-1@gated-at.bofh.it> |
Hello, I'm not sure how to properly escalate this bugreport, but I guess it's worth of at least of fast acknowledgement https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995871 bodik
[toc] | [next] | [standalone]
| From | Sylvain Beucler <beuc@beuc.net> |
|---|---|
| Date | 2021-10-09 19:50 +0200 |
| Message-ID | <D6oDU-1YE-15@gated-at.bofh.it> |
| In reply to | #5972 |
Hello, On 08/10/2021 10:54, Radoslav Bodó wrote: > I'm not sure how to properly escalate this bugreport, but I guess it's > worth of at least of fast acknowledgement > > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995871 You could upgrade the severity to 'grave', add the 'security' tag for this bug, and add a rationale on when 'disable_functions' is used as a first-level security protection. Though the most effective way to trigger the security workflow would be to get PHP Group to issue a CVE for this. They may plan to do so when they release a new fixed version themselves. Thanks for the info. Cheers! Sylvain Beucler Debian LTS Team
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web