Am 22.10.26 um 01:38 schrieb Adam Williamson:
"Standard Red Hat Enterprise Linux deployments use PHP-FPM rather than
mod_php. PHP-FPM workers exit on early initialization failures before
reaching the corrupted structures, so remote code execution is
difficult in practice and typically requires non-default behavior such
as parsing a second request body during script execution."
The developers of PHP see this differently. They wrote:
*"Who is at risk:* all PHP installations serving web requests, including
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed."
src: https://www.php.net/archive/2026.php#2026-10-21-5
I would think, they do know better how it works ;)
You referred to this for f43:
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d5f8446449
which is not the entire php build , it's an update package to the
missing update package of "php", to fix a version number.
It has already +6 karma at this time:
# 10:01 CEST
$ sudo dnf --enable-repo=updates-testing update php-fpm
Aktualisiere und lade Paketquellen:
Paketquellen geladen.
Nichts zu tun
$ rpm -q php-fpm
php-fpm-8.4.26-1.fc43.x86_64
My points:
a) it should not need karma, as it's an emergency patch for a critical
vulnerablility. so critical that security firms reaserching it shut down
their websites!!! (i.e. wordfence did)
I also had the opportunity to see the exploit at work. It's really
trivial and a wonder that it was under the hood for 22 years.
b) it does not matter at all, if one component i.e. php-fpm out of 4
use-cases -> "cgi,cli,fpm,mod_php" is safe, the rest is not.
Can now one pls push this to stable?
best regards,
Marius Schwarz
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
