com web/php: PHP 5.4.2 and PHP 5.3.12: ChangeLog-5.php archive/archive.xml archive/entries/2012-05-03-1.xml include/releases.inc include/version.inc
releases/5_3_12.php releases/5_4_2. php
| From: | Johannes Schlüter | Date: | Thu, 03 May 2012 16:02:22 +0000 |
| Subject: | com web/php: PHP 5.4.2 and PHP 5.3.12: ChangeLog-5.php archive/archive.xml archive/entries/2012-05-03-1.xml include/releases.inc include/version.inc releases/5_3_12.php releases/5_4_2. php |
||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-13444@lists.php.net to get a copy of this message | ||
Commit: 28ebea12da1a0b546f9361cbb6381211f09d1491
Author: Johannes Schlüter <johannes@schlueters.de> Thu, 3 May 2012 18:02:22 +0200
Parents: 1bf85c06095b90c27bcea564d48cf4c62ef825dd
Branches: master
Link: http://git.php.net/?p=web/php.git;a=commitdiff;h=28ebea12da1a0b546f9361cbb6381211f09d1491
Log:
PHP 5.4.2 and PHP 5.3.12
5.4.2 md5sums missing
Changed paths:
M ChangeLog-5.php
M archive/archive.xml
A archive/entries/2012-05-03-1.xml
M include/releases.inc
M include/version.inc
A releases/5_3_12.php
A releases/5_4_2.php
diff --git a/ChangeLog-5.php b/ChangeLog-5.php index ea7ba9e..76edc64 100644 --- a/ChangeLog-5.php +++ b/ChangeLog-5.php @@ -11,6 +11,24 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? <h1>PHP 5 ChangeLog</h1> +<a name="5.4.2"></a><!-- {{{ 5.4.2 --> +<h3>Version 5.4.2</h3> +<b>03-May-2012</b> + +<ul> + <li><?php bugfix(61910); ?> Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.</li> +</ul> +<!-- }}} --> + +<a name="5.3.12"></a><!-- {{{ 5.3.12 --> +<h3>Version 5.3.12</h3> +<b>03-May-2012</b> + +<ul> + <li><?php bugfix(61910); ?> Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.</li> +</ul> +<!-- }}} --> + <a name="5.4.1"></a><!-- {{{ 5.4.1 --> <h3>Version 5.4.1</h3> <b>26-Apr-2012</b> @@ -82,6 +100,7 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? paths).</li> </ul> </ul> +<!-- }}} --> <a name="5.3.11"></a><!-- {{{ 5.3.11 --> <h3>Version 5.3.11</h3> @@ -321,8 +340,9 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? <li><?php bugfix(61139); ?> (gzopen leaks when specifying invalid mode).</li> </ul> </ul> +<!-- }}} --> -<a name="5.4.0"></a><!-- {{{ 5.3.10 --> +<a name="5.4.0"></a><!-- {{{ 5.4.0 --> <h3>Version 5.4.0</h3> <b>01-Mar-2012</b> diff --git a/archive/archive.xml b/archive/archive.xml index 62c99b5..15881d3 100644 --- a/archive/archive.xml +++ b/archive/archive.xml @@ -9,6 +9,8 @@ <uri>http://php.net/contact</uri> <email>php-webmaster@lists.php.net</email> </author> + <xi:include href="entries/2012-05-03-1.xml"/> + <xi:include href="entries/2012-05-03-1.xml"/> <xi:include href="entries/2012-04-27-1.xml"/> <xi:include href="entries/2012-04-26-1.xml"/> <xi:include href="entries/2012-04-13-1.xml"/> diff --git a/archive/entries/2012-05-03-1.xml b/archive/entries/2012-05-03-1.xml new file mode 100644 index 0000000..57681d6 --- /dev/null +++ b/archive/entries/2012-05-03-1.xml @@ -0,0 +1,66 @@ +<?xml version="1.0" encoding="utf-8"?> +<entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 5.3.12 and PHP 5.4.2 Released!</title> + <id>http://www.php.net/archive/2012.php#id2012-05-03-1</id> + <published>2012-05-03T18:00:36+02:00</published> + <updated>2012-05-03T18:00:36+02:00</updated> + <category term="frontpage" label="PHP.net frontpage news"/> + <category term="releases" label="New PHP release"/> + <link href="http://www.php.net/index.php#id2012-05-03-1" rel="alternate" type="text/html"/> + <link href="http://www.php.net/archive/2012.php#id2012-05-03-1" rel="via" type="text/html"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> + + <p>There is a vulnerability in certain CGI-based setups that has gone + unnoticed for at least 8 years. <a href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section + 7 of the CGI spec</a> states:</p> + + <cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. + </cite> + + <p>So requests that do not have a "=" in the query string are treated + differently from those who do in some CGI implementations. For PHP this + means that a request containing ?-s may dump the PHP source code for the + page, but a request that has ?-s&=1 is fine.</p> + + <p>A large number of sites run PHP as either an Apache module through + mod_php or using php-fpm under nginx. Neither of these setups are + vulnerable to this. Straight shebang-style CGI also does not appear to + be vulnerable.</p> + + <p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see + if you are just add ?-s to the end of any of your URLs. If you see your + source code, you are vulnerable. If your site renders normally, you are not.</p> + + <p>Making a bad week worse, we had a bug in our bug system that toggled the + private flag of a bug report to public on a comment to the bug report + causing this issue to go public before we had time to test solutions to + the level we would like.</p> + + <p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since + this is a rather outdated way to run PHP it may not be feasible to + upgrade these sites to a modern version of PHP, so an alternative is to + configure your web server to not let these types of requests with query + strings starting with a "-" and not containing a "=" through. Adding a + rule like this should not break any sites. For Apache using mod_rewrite + it would look like this:</p> + + <pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] + </pre> + + <p>If you are writing your own rule, be sure to take the urlencoded ?%2ds + version into account.</p> + + <p>For source downloads of PHP 5.3.12 and PHP 5.4.2 please visit + our <a href="/downloads.php">downloads page</a>, Windows binaries can be found + on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A + <a href="/ChangeLog-5.php#5.4.2">ChangeLog</a> exists.</p> + </div> + </content> +</entry> diff --git a/include/releases.inc b/include/releases.inc index 508bde8..0d0dafe 100644 --- a/include/releases.inc +++ b/include/releases.inc @@ -2,6 +2,32 @@ $OLDRELEASES = array ( 5 => array ( + '5.4.1' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_4_1.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.4.1.tar.bz2', + 'name' => 'PHP 5.4.1 (tar.bz2)', + 'md5' => '5b9529ed89dbc48c498e9693d1af3caf', + 'date' => '26 April 2012', + ), + 1 => + array ( + 'filename' => 'php-5.4.1.tar.gz', + 'name' => 'PHP 5.4.1 (tar.gz)', + 'md5' => 'acd566dbd70f855c19d17fc3c0e876a2', + 'date' => '26 April 2012', + ), + ), + 'date' => '26 April 2012', + 'museum' => false, + ), '5.4.0' => array ( 'announcement' => @@ -28,6 +54,58 @@ $OLDRELEASES = array ( 'date' => '01 March 2012', 'museum' => false, ), + '5.3.11' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_3_11.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.3.11.tar.bz2', + 'name' => 'PHP 5.3.11 (tar.bz2)', + 'md5' => '5b9529ed89dbc48c498e9693d1af3caf', + 'date' => '26 April 2012', + ), + 1 => + array ( + 'filename' => 'php-5.3.11.tar.gz', + 'name' => 'PHP 5.3.11 (tar.gz)', + 'md5' => 'acd566dbd70f855c19d17fc3c0e876a2', + 'date' => '26 April 2012', + ), + ), + 'date' => '26 April 2012', + 'museum' => false, + ), + '5.3.10' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_3_10.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.3.10.tar.bz2', + 'name' => 'PHP 5.3.10 (tar.bz2)', + 'md5' => '816259e5ca7d0a7e943e56a3bb32b17f', + 'date' => '02 February 2012', + ), + 1 => + array ( + 'filename' => 'php-5.3.9.tar.gz', + 'name' => 'PHP 5.3.9 (tar.gz)', + 'md5' => '2b3d2d0ff22175685978fb6a5cbcdc13', + 'date' => '02 February 2012', + ), + ), + 'date' => '02 February 2012', + 'museum' => false, + ), '5.3.9' => array ( 'announcement' => diff --git a/include/version.inc b/include/version.inc index 38538bf..85ba7c3 100644 --- a/include/version.inc +++ b/include/version.inc @@ -20,24 +20,24 @@ $PHP_5_4_RC = false; // set to false when there is no RC $PHP_5_4_RC_DATE = "29 March 2012"; -$PHP_5_4_VERSION = "5.4.1"; -$PHP_5_4_DATE = "26 April 2012"; +$PHP_5_4_VERSION = "5.4.2"; +$PHP_5_4_DATE = "03 May 2012"; $PHP_5_4_MD5 = array( - "tar.bz2" => "5b9529ed89dbc48c498e9693d1af3caf", - "tar.gz" => "acd566dbd70f855c19d17fc3c0e876a2", + "tar.bz2" => "", + "tar.gz" => "", ); /* PHP 5.3 Release */ $PHP_5_3_RC = false; $PHP_5_3_RC_DATE = '12 April 2012'; -$PHP_5_3_VERSION = "5.3.11"; -$PHP_5_3_DATE = "26 April 2012"; +$PHP_5_3_VERSION = "5.3.12"; +$PHP_5_3_DATE = "03 May 2012"; $PHP_5_3_MD5 = array( - "tar.bz2" => "94709f6e7c920cbe26e19fa991d9975d", - "tar.gz" => "4f83556853ec997af837ad144d9fd156", + "tar.bz2" => "cf02c29be279c506cbd4ffc2819d7c82", + "tar.gz" => "aac80e478eb0785c50855ae8cefe735a", ); $RELEASES = array( diff --git a/releases/5_3_12.php b/releases/5_3_12.php new file mode 100644 index 0000000..8c7c81e --- /dev/null +++ b/releases/5_3_12.php @@ -0,0 +1,65 @@ +<?php +// $Id$ +$_SERVER['BASE_PAGE'] = 'releases/5_3_12.php'; +include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; +site_header("PHP 5.3.12 Release Announcement"); +?> + +<h1>PHP 5.3.12 Release Announcement</h1> + +<p>The PHP development team would like to announce the immediate +availability of PHP 5.3.12. This release delivers a security fix.</p> + +<p>There is a vulnerability in certain CGI-based setups that has gone +unnoticed for at least 8 years. <a +href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section +7 of the CGI spec</a> states:</p> + +<cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. +</cite> + +<p>So requests that do not have a "=" in the query string are treated +differently from those who do in some CGI implementations. For PHP this +means that a request containing ?-s may dump the PHP source code for the +page, but a request that has ?-s&a=1 is fine.</p> + +<p>A large number of sites run PHP as either an Apache module through +mod_php or using php-fpm under nginx. Neither of these setups are +vulnerable to this. Straight shebang-style CGI also does not appear to +be vulnerable.</p> + +<p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see +if you are just add ?-s to the end of any of your URLs. If you see your +source code, you are vulnerable. If your site renders normally, you are not.</p> + +<p>Making a bad week worse, we had a bug in our bug system that toggled the +private flag of a bug report to public on a comment to the bug report +causing this issue to go public before we had time to test solutions to +the level we would like.</p> + +<p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since +this is a rather outdated way to run PHP it may not be feasible to +upgrade these sites to a modern version of PHP, so an alternative is to +configure your web server to not let these types of requests with query +strings starting with a "-" and not containing a "=" through. Adding a +rule like this should not break any sites. For Apache using mod_rewrite +it would look like this:</p> + +<pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] +</pre> + +<p>If you are writing your own rule, be sure to take the urlencoded ?%2ds +version into account.</p> + +<p>For source downloads of PHP 5.3.12 please visit +our <a href="/downloads.php">downloads page</a>, Windows binaries can be found +on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A +<a href="/ChangeLog-5.php#5.3.12">ChangeLog</a> exists.</p> + +<?php site_footer(); ?> diff --git a/releases/5_4_2.php b/releases/5_4_2.php new file mode 100644 index 0000000..2234e69 --- /dev/null +++ b/releases/5_4_2.php @@ -0,0 +1,65 @@ +<?php +// $Id$ +$_SERVER['BASE_PAGE'] = 'releases/5_4_2.php'; +include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; +site_header("PHP 5.4.2 Release Announcement"); +?> + +<h1>PHP 5.4.2 Release Announcement</h1> + +<p>The PHP development team would like to announce the immediate +availability of PHP 5.4.2. This release delivers a security fix.</p> + +<p>There is a vulnerability in certain CGI-based setups that has gone +unnoticed for at least 8 years. <a +href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section +7 of the CGI spec</a> states:</p> + +<cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. +</cite> + +<p>So requests that do not have a "=" in the query string are treated +differently from those who do in some CGI implementations. For PHP this +means that a request containing ?-s may dump the PHP source code for the +page, but a request that has ?-s&a=1 is fine.</p> + +<p>A large number of sites run PHP as either an Apache module through +mod_php or using php-fpm under nginx. Neither of these setups are +vulnerable to this. Straight shebang-style CGI also does not appear to +be vulnerable.</p> + +<p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see +if you are just add ?-s to the end of any of your URLs. If you see your +source code, you are vulnerable. If your site renders normally, you are not.</p> + +<p>Making a bad week worse, we had a bug in our bug system that toggled the +private flag of a bug report to public on a comment to the bug report +causing this issue to go public before we had time to test solutions to +the level we would like.</p> + +<p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since +this is a rather outdated way to run PHP it may not be feasible to +upgrade these sites to a modern version of PHP, so an alternative is to +configure your web server to not let these types of requests with query +strings starting with a "-" and not containing a "=" through. Adding a +rule like this should not break any sites. For Apache using mod_rewrite +it would look like this:</p> + +<pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] +</pre> + +<p>If you are writing your own rule, be sure to take the urlencoded ?%2ds +version into account.</p> + +<p>For source downloads of PHP 5.4.2 please visit +our <a href="/downloads.php">downloads page</a>, Windows binaries can be found +on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A +<a href="/ChangeLog-5.php#5.4.2">ChangeLog</a> exists.</p> + +<?php site_footer(); ?>
diff --git a/ChangeLog-5.php b/ChangeLog-5.php index ea7ba9e..76edc64 100644 --- a/ChangeLog-5.php +++ b/ChangeLog-5.php @@ -11,6 +11,24 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? <h1>PHP 5 ChangeLog</h1> +<a name="5.4.2"></a><!-- {{{ 5.4.2 --> +<h3>Version 5.4.2</h3> +<b>03-May-2012</b> + +<ul> + <li><?php bugfix(61910); ?> Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.</li> +</ul> +<!-- }}} --> + +<a name="5.3.12"></a><!-- {{{ 5.3.12 --> +<h3>Version 5.3.12</h3> +<b>03-May-2012</b> + +<ul> + <li><?php bugfix(61910); ?> Fix PHP-CGI query string parameter vulnerability, CVE-2012-1823.</li> +</ul> +<!-- }}} --> + <a name="5.4.1"></a><!-- {{{ 5.4.1 --> <h3>Version 5.4.1</h3> <b>26-Apr-2012</b> @@ -82,6 +100,7 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? paths).</li> </ul> </ul> +<!-- }}} --> <a name="5.3.11"></a><!-- {{{ 5.3.11 --> <h3>Version 5.3.11</h3> @@ -321,8 +340,9 @@ function peclbugl($number) { echo "<a href=\"http://pecl.php.net/bugs/bug.php? <li><?php bugfix(61139); ?> (gzopen leaks when specifying invalid mode).</li> </ul> </ul> +<!-- }}} --> -<a name="5.4.0"></a><!-- {{{ 5.3.10 --> +<a name="5.4.0"></a><!-- {{{ 5.4.0 --> <h3>Version 5.4.0</h3> <b>01-Mar-2012</b> diff --git a/archive/archive.xml b/archive/archive.xml index 62c99b5..15881d3 100644 --- a/archive/archive.xml +++ b/archive/archive.xml @@ -9,6 +9,8 @@ <uri>http://php.net/contact</uri> <email>php-webmaster@lists.php.net</email> </author> + <xi:include href="entries/2012-05-03-1.xml"/> + <xi:include href="entries/2012-05-03-1.xml"/> <xi:include href="entries/2012-04-27-1.xml"/> <xi:include href="entries/2012-04-26-1.xml"/> <xi:include href="entries/2012-04-13-1.xml"/> diff --git a/archive/entries/2012-05-03-1.xml b/archive/entries/2012-05-03-1.xml new file mode 100644 index 0000000..57681d6 --- /dev/null +++ b/archive/entries/2012-05-03-1.xml @@ -0,0 +1,66 @@ +<?xml version="1.0" encoding="utf-8"?> +<entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 5.3.12 and PHP 5.4.2 Released!</title> + <id>http://www.php.net/archive/2012.php#id2012-05-03-1</id> + <published>2012-05-03T18:00:36+02:00</published> + <updated>2012-05-03T18:00:36+02:00</updated> + <category term="frontpage" label="PHP.net frontpage news"/> + <category term="releases" label="New PHP release"/> + <link href="http://www.php.net/index.php#id2012-05-03-1" rel="alternate" type="text/html"/> + <link href="http://www.php.net/archive/2012.php#id2012-05-03-1" rel="via" type="text/html"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> + + <p>There is a vulnerability in certain CGI-based setups that has gone + unnoticed for at least 8 years. <a href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section + 7 of the CGI spec</a> states:</p> + + <cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. + </cite> + + <p>So requests that do not have a "=" in the query string are treated + differently from those who do in some CGI implementations. For PHP this + means that a request containing ?-s may dump the PHP source code for the + page, but a request that has ?-s&=1 is fine.</p> + + <p>A large number of sites run PHP as either an Apache module through + mod_php or using php-fpm under nginx. Neither of these setups are + vulnerable to this. Straight shebang-style CGI also does not appear to + be vulnerable.</p> + + <p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see + if you are just add ?-s to the end of any of your URLs. If you see your + source code, you are vulnerable. If your site renders normally, you are not.</p> + + <p>Making a bad week worse, we had a bug in our bug system that toggled the + private flag of a bug report to public on a comment to the bug report + causing this issue to go public before we had time to test solutions to + the level we would like.</p> + + <p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since + this is a rather outdated way to run PHP it may not be feasible to + upgrade these sites to a modern version of PHP, so an alternative is to + configure your web server to not let these types of requests with query + strings starting with a "-" and not containing a "=" through. Adding a + rule like this should not break any sites. For Apache using mod_rewrite + it would look like this:</p> + + <pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] + </pre> + + <p>If you are writing your own rule, be sure to take the urlencoded ?%2ds + version into account.</p> + + <p>For source downloads of PHP 5.3.12 and PHP 5.4.2 please visit + our <a href="/downloads.php">downloads page</a>, Windows binaries can be found + on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A + <a href="/ChangeLog-5.php#5.4.2">ChangeLog</a> exists.</p> + </div> + </content> +</entry> diff --git a/include/releases.inc b/include/releases.inc index 508bde8..0d0dafe 100644 --- a/include/releases.inc +++ b/include/releases.inc @@ -2,6 +2,32 @@ $OLDRELEASES = array ( 5 => array ( + '5.4.1' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_4_1.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.4.1.tar.bz2', + 'name' => 'PHP 5.4.1 (tar.bz2)', + 'md5' => '5b9529ed89dbc48c498e9693d1af3caf', + 'date' => '26 April 2012', + ), + 1 => + array ( + 'filename' => 'php-5.4.1.tar.gz', + 'name' => 'PHP 5.4.1 (tar.gz)', + 'md5' => 'acd566dbd70f855c19d17fc3c0e876a2', + 'date' => '26 April 2012', + ), + ), + 'date' => '26 April 2012', + 'museum' => false, + ), '5.4.0' => array ( 'announcement' => @@ -28,6 +54,58 @@ $OLDRELEASES = array ( 'date' => '01 March 2012', 'museum' => false, ), + '5.3.11' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_3_11.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.3.11.tar.bz2', + 'name' => 'PHP 5.3.11 (tar.bz2)', + 'md5' => '5b9529ed89dbc48c498e9693d1af3caf', + 'date' => '26 April 2012', + ), + 1 => + array ( + 'filename' => 'php-5.3.11.tar.gz', + 'name' => 'PHP 5.3.11 (tar.gz)', + 'md5' => 'acd566dbd70f855c19d17fc3c0e876a2', + 'date' => '26 April 2012', + ), + ), + 'date' => '26 April 2012', + 'museum' => false, + ), + '5.3.10' => + array ( + 'announcement' => + array ( + 'English' => '/releases/5_3_10.php', + ), + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-5.3.10.tar.bz2', + 'name' => 'PHP 5.3.10 (tar.bz2)', + 'md5' => '816259e5ca7d0a7e943e56a3bb32b17f', + 'date' => '02 February 2012', + ), + 1 => + array ( + 'filename' => 'php-5.3.9.tar.gz', + 'name' => 'PHP 5.3.9 (tar.gz)', + 'md5' => '2b3d2d0ff22175685978fb6a5cbcdc13', + 'date' => '02 February 2012', + ), + ), + 'date' => '02 February 2012', + 'museum' => false, + ), '5.3.9' => array ( 'announcement' => diff --git a/include/version.inc b/include/version.inc index 38538bf..85ba7c3 100644 --- a/include/version.inc +++ b/include/version.inc @@ -20,24 +20,24 @@ $PHP_5_4_RC = false; // set to false when there is no RC $PHP_5_4_RC_DATE = "29 March 2012"; -$PHP_5_4_VERSION = "5.4.1"; -$PHP_5_4_DATE = "26 April 2012"; +$PHP_5_4_VERSION = "5.4.2"; +$PHP_5_4_DATE = "03 May 2012"; $PHP_5_4_MD5 = array( - "tar.bz2" => "5b9529ed89dbc48c498e9693d1af3caf", - "tar.gz" => "acd566dbd70f855c19d17fc3c0e876a2", + "tar.bz2" => "", + "tar.gz" => "", ); /* PHP 5.3 Release */ $PHP_5_3_RC = false; $PHP_5_3_RC_DATE = '12 April 2012'; -$PHP_5_3_VERSION = "5.3.11"; -$PHP_5_3_DATE = "26 April 2012"; +$PHP_5_3_VERSION = "5.3.12"; +$PHP_5_3_DATE = "03 May 2012"; $PHP_5_3_MD5 = array( - "tar.bz2" => "94709f6e7c920cbe26e19fa991d9975d", - "tar.gz" => "4f83556853ec997af837ad144d9fd156", + "tar.bz2" => "cf02c29be279c506cbd4ffc2819d7c82", + "tar.gz" => "aac80e478eb0785c50855ae8cefe735a", ); $RELEASES = array( diff --git a/releases/5_3_12.php b/releases/5_3_12.php new file mode 100644 index 0000000..8c7c81e --- /dev/null +++ b/releases/5_3_12.php @@ -0,0 +1,65 @@ +<?php +// $Id$ +$_SERVER['BASE_PAGE'] = 'releases/5_3_12.php'; +include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; +site_header("PHP 5.3.12 Release Announcement"); +?> + +<h1>PHP 5.3.12 Release Announcement</h1> + +<p>The PHP development team would like to announce the immediate +availability of PHP 5.3.12. This release delivers a security fix.</p> + +<p>There is a vulnerability in certain CGI-based setups that has gone +unnoticed for at least 8 years. <a +href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section +7 of the CGI spec</a> states:</p> + +<cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. +</cite> + +<p>So requests that do not have a "=" in the query string are treated +differently from those who do in some CGI implementations. For PHP this +means that a request containing ?-s may dump the PHP source code for the +page, but a request that has ?-s&a=1 is fine.</p> + +<p>A large number of sites run PHP as either an Apache module through +mod_php or using php-fpm under nginx. Neither of these setups are +vulnerable to this. Straight shebang-style CGI also does not appear to +be vulnerable.</p> + +<p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see +if you are just add ?-s to the end of any of your URLs. If you see your +source code, you are vulnerable. If your site renders normally, you are not.</p> + +<p>Making a bad week worse, we had a bug in our bug system that toggled the +private flag of a bug report to public on a comment to the bug report +causing this issue to go public before we had time to test solutions to +the level we would like.</p> + +<p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since +this is a rather outdated way to run PHP it may not be feasible to +upgrade these sites to a modern version of PHP, so an alternative is to +configure your web server to not let these types of requests with query +strings starting with a "-" and not containing a "=" through. Adding a +rule like this should not break any sites. For Apache using mod_rewrite +it would look like this:</p> + +<pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] +</pre> + +<p>If you are writing your own rule, be sure to take the urlencoded ?%2ds +version into account.</p> + +<p>For source downloads of PHP 5.3.12 please visit +our <a href="/downloads.php">downloads page</a>, Windows binaries can be found +on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A +<a href="/ChangeLog-5.php#5.3.12">ChangeLog</a> exists.</p> + +<?php site_footer(); ?> diff --git a/releases/5_4_2.php b/releases/5_4_2.php new file mode 100644 index 0000000..2234e69 --- /dev/null +++ b/releases/5_4_2.php @@ -0,0 +1,65 @@ +<?php +// $Id$ +$_SERVER['BASE_PAGE'] = 'releases/5_4_2.php'; +include_once $_SERVER['DOCUMENT_ROOT'] . '/include/prepend.inc'; +site_header("PHP 5.4.2 Release Announcement"); +?> + +<h1>PHP 5.4.2 Release Announcement</h1> + +<p>The PHP development team would like to announce the immediate +availability of PHP 5.4.2. This release delivers a security fix.</p> + +<p>There is a vulnerability in certain CGI-based setups that has gone +unnoticed for at least 8 years. <a +href="http://tools.ietf.org/html/draft-robinson-www-interface-00#section-7">Section +7 of the CGI spec</a> states:</p> + +<cite> + Some systems support a method for supplying a array of strings to the + CGI script. This is only used in the case of an `indexed' query. This + is identified by a "GET" or "HEAD" HTTP request with a URL search + string not containing any unencoded "=" characters. +</cite> + +<p>So requests that do not have a "=" in the query string are treated +differently from those who do in some CGI implementations. For PHP this +means that a request containing ?-s may dump the PHP source code for the +page, but a request that has ?-s&a=1 is fine.</p> + +<p>A large number of sites run PHP as either an Apache module through +mod_php or using php-fpm under nginx. Neither of these setups are +vulnerable to this. Straight shebang-style CGI also does not appear to +be vulnerable.</p> + +<p>If you are using Apache mod_cgi to run PHP you may be vulnerable. To see +if you are just add ?-s to the end of any of your URLs. If you see your +source code, you are vulnerable. If your site renders normally, you are not.</p> + +<p>Making a bad week worse, we had a bug in our bug system that toggled the +private flag of a bug report to public on a comment to the bug report +causing this issue to go public before we had time to test solutions to +the level we would like.</p> + +<p>To fix this update to PHP 5.3.12 or PHP 5.4.2. We recognize that since +this is a rather outdated way to run PHP it may not be feasible to +upgrade these sites to a modern version of PHP, so an alternative is to +configure your web server to not let these types of requests with query +strings starting with a "-" and not containing a "=" through. Adding a +rule like this should not break any sites. For Apache using mod_rewrite +it would look like this:</p> + +<pre> + RewriteCond %{QUERY_STRING} ^(%2d|-)[^=]+$ [NC] + RewriteRule ^(.*) $1? [L] +</pre> + +<p>If you are writing your own rule, be sure to take the urlencoded ?%2ds +version into account.</p> + +<p>For source downloads of PHP 5.4.2 please visit +our <a href="/downloads.php">downloads page</a>, Windows binaries can be found +on <a href="http://windows.php.net/download/">windows.php.net/download/</a>. A +<a href="/ChangeLog-5.php#5.4.2">ChangeLog</a> exists.</p> + +<?php site_footer(); ?>