Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.php > #13379
| From | Arno Welzel <usenet@arnowelzel.de> |
|---|---|
| Newsgroups | comp.lang.php |
| Subject | Re: Heartbleed bug? |
| Date | 2014-04-10 22:54 +0200 |
| Message-ID | <534704E9.9050904@arnowelzel.de> (permalink) |
| References | (3 earlier) <li3oid$2up$1@dont-email.me> <53456ab0$0$6618$9b4e6d93@newsspool4.arcor-online.net> <li40fs$8bs$1@dont-email.me> <53463F6B.5010406@arnowelzel.de> <li60kv$vd4$1@dont-email.me> |
Jerry Stuckle, 2014-04-10 13:52: > On 4/10/2014 2:51 AM, Arno Welzel wrote: >> Jerry Stuckle, 2014-04-09 19:37: >> >>> On 4/9/2014 11:43 AM, Christoph Michael Becker wrote: >> [...] >>>> ACK. However, the Windows x86 builds of PHP 5.5.11 shipped OpenSSL >>>> 1.0.1f (6 Jan 2014) and have been updated to ship OpenSSL 1.0.1g (7 Apr >>>> 2014) just a few hours ago. (The x64 builds are currently being worked >>>> on.) So obviously PHP's OpenSSL extension is affected by the >>>> "heartbleed" bug (at least on Windows). >>>> >>> >>> Does it? Or does it mean they just want to keep up with the latest >>> release? And if it does affect PHP, what functions does it affect, and >>> how does it affect them? >> >> I assume PHP does keep up with the latest release because they *are* >> affected by the bug e.g. in stream_socket_enable_crypto(). >> >> > > You can ASS-U-ME all you want. I go by the facts. And if I were Oh you are so funny... > concerned about PHP being involved, I would ask the OpenSSL people. The fact is, that stream_socket_enable_crypto() allows to build a server which listens on a socket to accept incoming SSL/TLS connections and uses OpenSSL for this. OpenSSL up to 1.0.1f has a now well known vulnerability for that use case. Ask who ever you want. If you got the answers that prove all this wrong, do the rest of us a favour and tell us. -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de http://fahrradzukunft.de
Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200
csiph-web