Security - PHP RCEs reported

richardtoohey2 said:
Today's (unrelated) other security news: compromised CA

eMudhra Intermediate CA Compromise

eMudhra Intermediate CA Compromise
emudhra.we-have-a-problem.com
Click to expand...
Thanks! There's commands posted for FreeBSD 14+ at the bottom:
Code: 
cp /etc/ssl/certs/14bc7599.0 /usr/share/certs/untrusted/14bc7599.pem
cp /etc/ssl/certs/ee64a828.0 /usr/share/certs/untrusted/ee64a828.pem
certctl rehash

ee64a828.pem didn't exist for me on 15.1, but the other 2 ran fine
 
janprzy said:
Will the update immediately be available in the pkg repositories or will we have to wait a while?
Click to expand...
No, the packages have to be rebuild first. The fixed version *might* be available in the ports tree though - *IF* the maintainer was included in the coordinated release of the patches and he managed to prepare working patches (i.e. no build errors/problems), and *IF* he could arrange with a committer to get it pushed ASAP the patched versions *could* be available in the ports tree at or closely around the official release date.
Otherwise we have to wait for the patches to be released by the php project, someone updating and test-building the ports, creating a PR and getting the patches committed. (i.e. the standard procedure for patches against a port).
 
Hi,

Can see the new versions hit ports very quickly, but no sign of anything in packages yet (quarterly).

The Forums message made it sound like they (forums) waiting on the pkg repo, then that changed to building from own repo.

Is there any information on when PHP binary packages will be available in quarterly/latest?

I've taken machines offline so I'd like to know roughly when I can upgrade them and bring them back online.

Thank you.
 
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
 
DutchDaemon said:
Yes, the disparity between the updated PHP ports appearing in the ports tree (which was about 15 minutes before PHP.org itself said there would be an update) and them being available in packaged form is really something to think about for those running the pipeline.

I'm sure everybody is working their butts off, but something running 70% of websites worldwide (or so I heard) should be available in packaged form much much faster,  specifically on FreeBSD (the stable, secure server OS), even more so when there is a big push to switch to the packaged base system, which ceases to be optional one major version from now.
Click to expand...

Right now it is an essential skill to mix individual, single ports into a pkg tree.
 
marzl said:
who has contact to "the one" who is in charge/control doing this build? Any chances to speed that up a tiny bit?
Click to expand...
There isn't any alternative mechanism in play right now other than a full build.

You could just copy custom made new php packages to the pkg mirror, but then consistency between those packages and all the other ones is uncertain. Because the git version of the ports tree is different and php would not be the only change.

I think you would have to do some git surgery. Take a ports tree of the revision that built the last full pkg collection. Merge just the php fixes from head, nothing else. Then build php and copy it over to the mirrors that have that version of the pkg collection.
 
That's something poudriere is very good at. You can just grep the php ports out of your build file, turn it into a new build file, and feed only those ports to poudriere. When those are built, you switch back to your old build file. Everything stays healthy. Meanwhile, you have your updated PHP packages in a matter of minutes.

This is not something I do routinely, by the way, but if there's something I need now and I can see that Rust has an update as well. Yeah, Rust can build later..
 
You must log in or register to reply here.
Back
Top