security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
security [2017/09/22 13:28] – external edit 127.0.0.1security [2024/01/30 17:35] (current) – derick
Line 3: Line 3:
    * Authors: Release Managers    * Authors: Release Managers
    * Date: November 2016    * Date: November 2016
-   * Version: 1.0.0+   * Version: 1.0.1
    * RFC: [[rfc:security-classification|Security Issue Classification]]    * RFC: [[rfc:security-classification|Security Issue Classification]]
 +
 +<blockquote>**The canonical version of this document now lives at https://github.com/php/policies/blob/main/security-classification.rst**</blockquote>
  
 ====== Introduction ====== ====== Introduction ======
Line 77: Line 79:
   * requires the use of non-standard builds - ex. obscure embedded platform, not commonly used compiler   * requires the use of non-standard builds - ex. obscure embedded platform, not commonly used compiler
   * requires the use of code or settings known to be insecure   * requires the use of code or settings known to be insecure
 +  * requires the use of FFI
 +  * requires an open_basedir bypass
 +
  
 ====== Handling issues ====== ====== Handling issues ======
Line 83: Line 88:
  
 Low severity fixes are merged immediately after the fix is available and handled like all regular bugs are handled consequently. However, release managers may choose to pull those fixes into the RC branch after the branch is created, and also backport them into security-only release branch.  Low severity fixes are merged immediately after the fix is available and handled like all regular bugs are handled consequently. However, release managers may choose to pull those fixes into the RC branch after the branch is created, and also backport them into security-only release branch. 
 +
  
 ====== FAQ ====== ====== FAQ ======
  
 Q. How do I report a security issue?\\ Q. How do I report a security issue?\\
-A. Please report it on http://bugs.php.net, choosing type "Security". This will automatically make it private. If for some reason you can not do that, or need to talk to somebody about a PHP security issue that is not exactly a bug report, please write to security@php.net. +A. Please report it on http://bugs.php.net, choosing type "Security". This will automatically make it private. If for some reason you can not do that, or need to talk to somebody about a PHP security issue that is not exactly a bug report, please write to security@php.net. You can also submit a security report on Github: https://github.com/php/php-src/security/advisories/new
  
 Q. What do you consider a responsible disclosure?\\ Q. What do you consider a responsible disclosure?\\
security.1506086901.txt.gz · Last modified: 2017/09/22 13:28 by 127.0.0.1

Page Tools