Am 22.10.26 um 18:35 schrieb Adam Williamson:
Gah - I meant "This implies that there isnot a demonstrated pre-auth RCE exploit for php-fpm or php-cgi (etc.)"
CLI is unlikely at risk, i agree here. But it also proves the point, just because one if safe, the rest is not automatically safe too. And yes, maybe it's harder to exploit it via php-fpm , with limited memory access, but it's not a guarantee it will hold long.
You don't know, how "end users" using the product. there could be thousands of never changed mod_php setups. You will never know. So "assuming" is the wrong approach IMHO.
PHP stated, that they expect to see working exploits 15 minutes after release of the patch.
if the mirroring of the packages started at 16:00 CEST, ~30 minutes later everyone could had have the updates installed and be safer. (sidenote: it took 4 devs 2 months to build a working fix , and they are not sure, it's 100%).
Don't get me wrong, no hate here. The availability in Koji enabled me to have them 10 minutes later on our repo, that was way faster than expected. I just don't get why it was handled, like it was. btw: Is remi finally on vaccation? :) If so, have a good time, you deserve it, php hero.
I had other issues, where we i.e. had Apache dos problems that got solved and pushed within 7h after the initial bugreport. From my POV towards Fedora, it's possible to ship important updates in a short time. So my expectations are high. I had so much good impression regarding fast security updates over the past 15 years, ok, some bad too ofcourse, so I hope you understand why i was more than surprised that it took so long for such a magnitude of an issue.
Other major distros like debian had the packages rdy at 16:00 CEST, to be fair, canonical had own issues, but it shows, that "the majority" disagrees about the way fedora handling this special release.
This may be a good starting point to reconsider handling security differently in the light of AIs producing exploits, faster than you can imagine.
PS: the update notice of php 8.4.27(-1 and all subpackages of -1 and -2) never hit the security update mailing list. Which shows me, that the packagebuild & push to the repos was not normal. This should be resolved internally.
Best regards@* Marius Schwarz -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
