[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALwr1G=mfjVLrsYN0Yi33UV82F3520Nsm0CpFbFx-AB1J5D+rA@mail.gmail.com>
Date: Mon, 11 May 2015 20:03:28 +0100
From: Pádraic Brady <padraic.brady@...il.com>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: CVE Request: Insufficient TLS Protection in Composer (PHP)
Hi all,
A brief update to clarify this is a CVE request in the subject line
and copy the guys at MITRE. Also to clarify that this vulnerability
occurs from relying the PHP openssl extensions default configuration.
That default configuration disables peer verification on PHP versions
less than PHP 5.6 (when it was significantly reworked to be more
secure by default).
On 25 April 2015 at 19:49, Pádraic Brady <padraic.brady@...il.com> wrote:
> My I request a CVE ID for the following, which is a publicly disclosed
> unpatched vulnerability on Composer's issue tracker since 2012.
> Composer is an open source package manager for PHP. The specific issue
> pertaining to this request is a failure to perform TLS peer
> verification on remote requests when making any API request or
> retrieving any file, i.e. there is a singular client class.
>
> Ref: https://github.com/composer/composer/issues/1074
>
> Kind regards,
> Paddy
>
> --
> Pádraic Brady
Kind regards,
Paddy
--
Pádraic Brady
http://blog.astrumfutura.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
