Actions
Bug #6113
closedWorkaround for Poxy potential vulnerabilities on unpatched Apache CVE-2016-5387 and PHP CVE-2016-5385
Actions
Added by beat over 8 years ago. Updated almost 8 years ago.
Btw, Guzzle 6.2.2 now has a fork for PHP 5.3: https://packagist.org/packages/ehough/guzzle
As it has a different namespace, both PHP 5.5 versions and PHP 5.3 versions can be packaged.
Not for 2.1.1, but adding the note here to keep it in mind.
In fact, that is an Apache PHP vulnerability, only exploitable in some scripts, and Guzzle's fix is just implementing the avoiding of this vulnerability.
After security assessment, we believe that this vulnerability is not exploitable in core CB, and also in none of our CB Add-on uses of Guzzle, due to a second layer of security in the protocols used.