Added by beat over 9 years ago. Updated almost 9 years ago.
Updated by beat over 9 years ago
Actions
#1
Updated by krileon about 9 years ago
Actions
#2
Updated by beat almost 9 years ago
Actions
#3
Updated by beat almost 9 years ago
Actions
#4
Btw, Guzzle 6.2.2 now has a fork for PHP 5.3: https://packagist.org/packages/ehough/guzzle
As it has a different namespace, both PHP 5.5 versions and PHP 5.3 versions can be packaged.
Not for 2.1.1, but adding the note here to keep it in mind.
Updated by beat almost 9 years ago
Actions
#5
Fixed in MR !1224
Updated by beat almost 9 years ago
Actions
#6
Updated by beat almost 9 years ago
Actions
#7
In fact, that is an Apache PHP vulnerability, only exploitable in some scripts, and Guzzle's fix is just implementing the avoiding of this vulnerability.
After security assessment, we believe that this vulnerability is not exploitable in core CB, and also in none of our CB Add-on uses of Guzzle, due to a second layer of security in the protocols used.
Updated by beat almost 9 years ago
Actions
#8