Re: Heartbleed bug?

From	"M. Strobel" <sorry_no_mail_here@nowhere.dee>
Newsgroups	comp.lang.php
Subject	Re: Heartbleed bug?
Date	2014-04-10 00:11 +0200
Message-ID	<bqlut8Fj6fnU1@mid.uni-berlin.de> (permalink)
References	(1 earlier) <li3h9p$ab4$1@dont-email.me> <VaadncnjeJs3zNjOnZ2dnUVZ_gmdnZ2d@giganews.com> <li3oid$2up$1@dont-email.me> <sL-dnfchC9A38NjOnZ2dnUVZ_tudnZ2d@giganews.com> <li40ir$8bs$2@dont-email.me>

Show all headers | View raw

Am 09.04.2014 19:38, schrieb Jerry Stuckle:
> On 4/9/2014 11:56 AM, Robert Heller wrote:
>> At Wed, 09 Apr 2014 11:21:51 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>
>>>
>>> On 4/9/2014 9:56 AM, Robert Heller wrote:
>>>> At Wed, 09 Apr 2014 09:17:46 -0400 Jerry Stuckle <jstucklex@attglobal.net> wrote:
>>>>
>>>>>
>>>>> On 4/9/2014 8:24 AM, Kevin Burton wrote:
>>>>>> Anyone know how this bug http://heartbleed.com/ affects PHP when the extension
>>>>>> is enabled? Is there a patch for the extension?
>>>>>>
>>>>>
>>>>> You need to be asking the OpenSSL people what products their bug affects.
>>>>
>>>> Since this is a shared library on a typical Linux system (eg LAMP server), it
>>>> will affect any program that links with OpenSSL's library(-ies).  I know that
>>>> at least the CentOS user group is talking about it and I am sure RedHat is
>>>> also looking at it.  (A large number of LAMP servers run CentOS.)
>>>>
>>>>>
>>>>
>>>
>>> That may or may not be.  It depends on exactly what the problem is - or
>>> exactly what it affects.  From the description on the website, I can't
>>> tell.  Can you?
>>>
>>> Obviously, though, those who know the code would know exactly what it
>>> affects.
>>>
>>> A bug in a program does not necessarily affect everything that touches
>>> that program!
>>
>> According to the CentOS mailing list, a patched version of the openssl
>> libraries was released yesterday.  Only one version of CentOS (and I guess
>> RHEL) were affected: 6.5.  The patched version of the openssl fixes that (one
>> also needs to remake certificates (with new private keys!) and revoke the old
>> ones. CentOS 5 and CentOS 6.4 and earlier were NOT affected.  In *my* case
>> (deepsoft.com) since I run CentOS 5, *my* server is not affected. It is my
>> understanding that a *large* number of LAMP webservers are running some
>> version of CentOS.  I presume that the system admins of the affected systems
>> are on the CentOS mailing list and are on top of things.
>>
>>>
>>>
>>
> 
> That may be.  But it still doesn't answer your original question as to how (or even
> if) it affects PHP.
> 

In german we call this "bug" a "GAU", that means "Maximum Credible Accident". You'd
better *make sure* you are not affected. Starting point: you are.

There seem to be "just a few versions" of openssl affected, but for those who are it
is a GAU.

/Str.

Thread

Heartbleed bug? Kevin Burton <ronald.kevin.burton@gmail.com> - 2014-04-09 05:24 -0700
  Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 09:17 -0400
    Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 08:56 -0500
      Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 11:21 -0400
        Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-09 17:43 +0200
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:37 -0400
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:51 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:52 -0400
                Re: Heartbleed bug? Christoph Michael Becker <cmbecker69@arcor.de> - 2014-04-10 14:03 +0200
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 12:36 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:01 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 00:47 +0100
                Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-11 00:38 +0000
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 21:58 -0400
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-11 02:59 +0000
                Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-11 04:36 +0100
                Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-11 12:08 -0400
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:54 +0200
                Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 22:45 +0000
                Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:33 +0200
              Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:47 +0000
        Re: Heartbleed bug? Robert Heller <heller@deepsoft.com> - 2014-04-09 10:56 -0500
          Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-09 13:38 -0400
            Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 00:11 +0200
              Re: Heartbleed bug? Jerry Stuckle <jstucklex@attglobal.net> - 2014-04-10 07:53 -0400
          Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-09 21:02 +0100
  Re: Heartbleed bug? Adam Harvey <usenet@adamharvey.name> - 2014-04-09 23:43 +0000
    Re: Heartbleed bug? Eli the Bearded <*@eli.users.panix.com> - 2014-04-10 00:01 +0000
  Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:43 +0200
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 08:57 +0200
      Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:50 +0000
        Re: Heartbleed bug? The Natural Philosopher <tnp@invalid.invalid> - 2014-04-10 19:37 +0100
        Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-10 22:56 +0200
          Re: Heartbleed bug? "M. Strobel" <sorry_no_mail_here@nowhere.dee> - 2014-04-10 23:32 +0200
          Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 23:14 +0000
            Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 08:23 +0200
  Re: Heartbleed bug? Denis McMahon <denismfmcmahon@gmail.com> - 2014-04-10 15:42 +0000
    Re: Heartbleed bug? Arno Welzel <usenet@arnowelzel.de> - 2014-04-11 13:00 +0200

csiph-web