Bug->Req #70134 [Opn->Asn]: open_basedir bypass with IP-based PHP-FPM

Edit report at https://bugs.php.net/bug.php?id=70134&edit=1 ID: 70134 Updated by: bukka@php.net Reported by: butesa at freenet dot de Summary: open_basedir bypass with IP-based PHP-FPM -Status: Open +Status: Assigned -Type: Bug +Type: Feature/Change Request Package: FPM related Operating System: Ubuntu PHP Version: 5.5.27 -Assigned To: +Assigned To: bukka Block user comment: N Private report: N New Comment: This is a feature request as this behaviour is on purpose. Previous Comments: ------------------------------------------------------------------------ [2021-07-12 15:41:04] cmb@php.net open_basedir bypasses are not considered to be security issues; cf. <https://externals.io/message/105606> and <https://externals.io/message/115406>. ------------------------------------------------------------------------ [2020-01-14 21:45:51] diego dot blanco at treitos dot com Additionally it seems that open_basedir is bypassed by fsocksopen when using unix sockets, so this is also exploitable with unix sockets. ------------------------------------------------------------------------ [2018-01-19 19:40:51] bohu at cryp dot email This critical security issue is still present in PHP 7.0. At least on Debian Stretch PHP 7.0.27-0+deb9u1. Any plan to patch it ? Thx ! ------------------------------------------------------------------------ [2017-04-19 10:03:39] xuanhung1606 at gmail dot com http://tnghomes.net/ ------------------------------------------------------------------------ [2015-07-24 20:46:27] butesa at freenet dot de Sorry, I didn't mean to make this bug report private. There is no sensible information in it. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70134 -- Edit this bug report at https://bugs.php.net/bug.php?id=70134&edit=1