Req #60491 [Com]: Session module is adoptive

Edit report at https://bugs.php.net/bug.php?id=60491&edit=1 ID: 60491 Comment by: yqbjtu at 163 dot com Reported by: yohgaki@php.net Summary: Session module is adoptive Status: Closed Type: Feature/Change Request Package: Session related Operating System: All PHP Version: Irrelevant Assigned To: yohgaki Block user comment: N Private report: N CVE-ID: 2011-4718 New Comment: is PHP5.4 affected by this CVE-2011-4718? I see it is fixed in 5.5.2. but how about the php 5.4 serials, such as the latest php 5.4.36? Thank you! Previous Comments: ------------------------------------------------------------------------ [2014-02-25 05:00:54] yohgaki@php.net This is closed. Use use_strict_mode=on. ------------------------------------------------------------------------ [2014-02-25 01:24:42] johannes@php.net yasuo-san, please confirm this can be closed (and marked public). ------------------------------------------------------------------------ [2014-02-12 17:15:41] tyrael@php.net this should be closed, as it is fixed since 5.5.2 with the addition of the strict sessions, right? ------------------------------------------------------------------------ [2011-12-10 00:52:07] yohgaki@php.net Description: ------------ Session module is adoptive, so there are chances for session fixation due to adoption. CVE ID: CVE-2011-4718 https://wiki.php.net/rfc/strict_sessions ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=60491&edit=1