Bug #74182 [NEW]: Unsafe default for opcache.validate_permission

From: michael at orlitzky dot com Operating system: PHP version: Irrelevant Package: opcache Bug Type: Bug Bug description:Unsafe default for opcache.validate_permission Description: ------------ The opcache.validate_permission setting was introduced to fix a vulnerability (now CVE-2015-8994) in shared hosting environments. However, it defaults to "0", meaning it's off. The performance impact of the additional check should not be cataclysmic, and shared hosting is almost synonymous with PHP. As a result, I think the default should be opcache.validate_permission=1. Reference: http://www.openwall.com/lists/oss-security/2017/02/27/4 -- Edit bug report at https://bugs.php.net/bug.php?id=74182&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74182&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74182&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74182&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74182&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74182&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74182&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74182&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74182&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74182&r=support Expected behavior: https://bugs.php.net/fix.php?id=74182&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74182&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74182&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74182&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74182&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74182&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74182&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74182&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74182&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74182&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74182&r=mysqlcfg