security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
security [2016/11/01 22:12]
stas
security [2019/11/04 08:31] (current)
krakjoe add explicit FFI clause
Line 1: Line 1:
 +====== Meta ======
 +
 +   * Authors: Release Managers
 +   * Date: November 2016
 +   * Version: 1.0.1
 +   * RFC: [[rfc:​security-classification|Security Issue Classification]]
 +
 +====== Introduction ======
 +
 For the sake of our users, we classify some of the issues found in PHP as "​security issues"​. This document is intended to explain which issues are thus classified, how we handle those issues and how to report them. For the sake of our users, we classify some of the issues found in PHP as "​security issues"​. This document is intended to explain which issues are thus classified, how we handle those issues and how to report them.
  
Line 29: Line 38:
 This category also may include issues that require special code or code pattern if such code or pattern is present in many popular libraries. This category also may include issues that require special code or code pattern if such code or pattern is present in many popular libraries.
  
-This kind of issues usually ​require ​a CVE report.+This kind of issues usually ​requires ​a CVE report.
  
 ===== Medium severity ===== ===== Medium severity =====
Line 45: Line 54:
 ===== Low severity ===== ===== Low severity =====
  
-This issue allows theoretical compromise of security, but practical attack is usually impossible or extremely hard due to common practices or limitations that are virtually always present. ​+This issue allows theoretical compromise of security, but practical attack is usually impossible or extremely hard due to common practices or limitations that are virtually always present ​or imposed
  
 This also includes problems with configuration,​ documentation,​ and other non-code parts of the PHP project that may mislead users, or cause them to make their system, or their code less secure. ​ This also includes problems with configuration,​ documentation,​ and other non-code parts of the PHP project that may mislead users, or cause them to make their system, or their code less secure. ​
Line 53: Line 62:
 Security issues, that are present only in unstable branches, belong to this category, too. Any branch that has no stable release, is per se not intended for the production use. Security issues, that are present only in unstable branches, belong to this category, too. Any branch that has no stable release, is per se not intended for the production use.
  
-Low severity issues usually do not need to have CVE and may, at the discretion of the discoverer, be disclosed publicly before the fix is released or available. ​+Low severity issues usually do not need to have CVE and may, at the discretion of the PHP developers, be disclosed publicly before the fix is released or available. ​
  
 ===== Not a security issue ===== ===== Not a security issue =====
Line 59: Line 68:
 We do not classify as a security issue any issue that:  We do not classify as a security issue any issue that: 
  
-  * requires invocation of specific code (unless it is a very simple frequently used code, such as starting a session, calling a constructor,​ throwing an exception, etc.) +  * requires invocation of specific code, which may be valid but is obviously malicious 
-  * requires invocation of functions with specific arguments ​(unless such arguments commonly ​are supplied by the external user in typical code - e.g. bug in input sanitizing functions). ​ +  * requires invocation of functions with specific arguments, which may be valid but are obviously malicious 
-  * requires specific actions to be performed on the server ​to trigger it, which is not commonly performed ​and is not commonly ​accessible to the remote ​user+  * requires specific actions to be performed on the server, which are not commonly performed, or are not commonly ​permissible for the user (uid) executing PHP
   * requires privileges superior to that of the user (uid) executing PHP   * requires privileges superior to that of the user (uid) executing PHP
   * requires the use of debugging facilities - ex. xdebug, var_dump   * requires the use of debugging facilities - ex. xdebug, var_dump
   * requires the use of settings not recommended for production - ex. error reporting to output   * requires the use of settings not recommended for production - ex. error reporting to output
   * requires the use of non-standard environment variables - ex. USE_ZEND_ALLOC   * requires the use of non-standard environment variables - ex. USE_ZEND_ALLOC
-  * requires the use of non-standard builds+  * requires the use of non-standard builds ​- ex. obscure embedded platform, not commonly used compiler
   * requires the use of code or settings known to be insecure   * requires the use of code or settings known to be insecure
 +  * requires the use of FFI
 +
  
 ====== Handling issues ====== ====== Handling issues ======
Line 78: Line 89:
  
 Q. How do I report a security issue?\\ Q. How do I report a security issue?\\
-A. Please report it on http://​bugs.php.net,​ choosing type "​Security"​. This will automatically make it private. If for some reason you can not do that, or need to talk to somebody about PHP security issue that is not exactly a bug report, please write to security@php.net. ​+A. Please report it on http://​bugs.php.net,​ choosing type "​Security"​. This will automatically make it private. If for some reason you can not do that, or need to talk to somebody about PHP security issue that is not exactly a bug report, please write to security@php.net. ​
  
 Q. What do you consider a responsible disclosure?​\\ Q. What do you consider a responsible disclosure?​\\
security.1478038375.txt.gz · Last modified: 2017/09/22 13:28 (external edit)