Bug #73342 [Ver->Csd]: Vulnerability in php-fpm by changing stdin to non-blocking

Edit report at https://bugs.php.net/bug.php?id=73342&edit=1 ID: 73342 Updated by: nikic@php.net Reported by: xuavis at gmail dot com Summary: Vulnerability in php-fpm by changing stdin to non-blocking -Status: Verified +Status: Closed Type: Bug Package: FPM related Operating System: Ubuntu 16.04 PHP Version: 7.0Git-2016-10-18 (Git) Assigned To: bukka Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=69dee5c732fe982c82edb17d0dbc3e79a47748d8 Log: Fixed bug #73342 Previous Comments: ------------------------------------------------------------------------ [2018-06-20 10:22:54] DEBANANDA dot PAL at GMAIL dot COM Hi Our current php5 version is 5.6.34. Pls let me know, if we can apply the patch (described in below link) to php5 5.6.34 https://bugs.php.net/bug.php?id=73342&thanks=3 Thanks, D Pal ------------------------------------------------------------------------ [2018-06-12 18:42:12] nikic@php.net @bukka: PR up at https://github.com/php/php-src/pull/3287. ------------------------------------------------------------------------ [2018-06-12 17:45:40] nikic@php.net @bukka: I can't remember writing it, but I have this test against the old infrastructure lying around: https://gist.github.com/nikic/5904446746a7f90f98e856e6dda592ee I'll port it and submit a PR. ------------------------------------------------------------------------ [2018-06-12 17:34:43] bukka@php.net I just merged the test revamp. Think that the test for this could be similar to the one for fastcgi_finish_request - https://git.io/vhrAj . Of course the PHP code will be different (as test script) and there should be probably two requests and possibly some other changes - not exactly sure atm. as I would have to try it but think you will get the idea ;) ------------------------------------------------------------------------ [2018-06-12 16:55:01] bukka@php.net Btw. I would a bit careful as we are breaking FastCGI "spec" (it's not really a spec though and it doesn't seem to be a useful part anywya) so maybe we should just target 7.2 first and then possibly back port it. WDT? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=73342 -- Edit this bug report at https://bugs.php.net/bug.php?id=73342&edit=1