Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-10-10 Thread Stas Malyshev
Hi! > When do you plan to release a new 5.4.34 / 5.5.18 version with a fix for Next week. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-10-10 Thread jocelyn fournier
Hi, When do you plan to release a new 5.4.34 / 5.5.18 version with a fix for those issues ? I'm concerned because our app is just broken with this issue. Moreover 5.4.33 / 5.5.17 are used in some PHP Buildpack on PAAS platform like cloudfoundry/pivotal, they are directly affected by the probl

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-10-04 Thread jocelyn fournier
Hi, It would perhaps be great to communicate on this nasty bug on the PHP website ? For example code based on amqplib + ssl (https://github.com/videlalvaro/php-amqplib) is not working anymore as well, and it could be a headache to figure out why it's not working. I assume a lot more libs coul

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-25 Thread Ferenc Kovacs
On Thu, Sep 25, 2014 at 7:28 AM, Daniel Lowrey wrote: > > FYI: I've tagged 5.6.1 and I had to revert the following commits for > this: > > 372844918a318ad712e16f9ec636682424a65403 > > f86b2193a483f56b0bd056570a0cdb57ebe66e2f > > 30a73658c63a91c413305a4c4d49882fda4dab3e > > 84a4041ba47e92e7a0ba039

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-25 Thread Daniel Lowrey
Hi! I'm typing on my phone at the airport so apologies for the brevity and lack of quoting from previous messages. I will summarize everything in detail with commit references to clear up any confusion in the next couple of days. I believe that by applying the patch below to the 5.4 and 5.5 branch

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-25 Thread Stas Malyshev
Hi! > I will review and report back on the 5.6.1 later today. I've checked with > the horde folks and my recent uncommitted patch resolves any bugs (both old > and new). I plan to commit this for 5.4 and 5.5 today and then subsequently What is this new patch? Please note 5.4 is now supposed to be

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-24 Thread Daniel Lowrey
> FYI: I've tagged 5.6.1 and I had to revert the following commits for this: > 372844918a318ad712e16f9ec636682424a65403 > f86b2193a483f56b0bd056570a0cdb57ebe66e2f > 30a73658c63a91c413305a4c4d49882fda4dab3e > 84a4041ba47e92e7a0ba03938d0ebf88b5fcf6cf > 98e67add15a6b889efe152c23ed15a61f022a63a > > 98e

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-24 Thread Daniel Lowrey
On Wed, Sep 24, 2014 at 5:41 AM, Ferenc Kovacs wrote: > > > > On Tue, Sep 23, 2014 at 4:41 PM, Julien Pauli wrote: >> >> On Tue, Sep 23, 2014 at 3:24 PM, Ferenc Kovacs wrote: >> > >> > >> > On Tue, Sep 23, 2014 at 7:39 AM, Daniel Lowrey wrote: >> >> >> >> >> Hi, >> >> >> >> >> >> That's a bad t

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-24 Thread Ferenc Kovacs
On Tue, Sep 23, 2014 at 4:41 PM, Julien Pauli wrote: > On Tue, Sep 23, 2014 at 3:24 PM, Ferenc Kovacs wrote: > > > > > > On Tue, Sep 23, 2014 at 7:39 AM, Daniel Lowrey > wrote: > >> > >> >> Hi, > >> >> > >> >> That's a bad thing we need to fix ASAP. > >> >> > >> >> I think for 5.6.1 we'll rever

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-23 Thread Julien Pauli
On Tue, Sep 23, 2014 at 3:24 PM, Ferenc Kovacs wrote: > > > On Tue, Sep 23, 2014 at 7:39 AM, Daniel Lowrey wrote: >> >> >> Hi, >> >> >> >> That's a bad thing we need to fix ASAP. >> >> >> >> I think for 5.6.1 we'll revert it , if not, we'll need an RC2, which >> >> is something we usually don't d

Re: [PHP-DEV] Re: Re: OpenSSL bug in 5.4.33 and 5.5.17

2014-09-23 Thread Ferenc Kovacs
On Tue, Sep 23, 2014 at 7:39 AM, Daniel Lowrey wrote: > >> Hi, > >> > >> That's a bad thing we need to fix ASAP. > >> > >> I think for 5.6.1 we'll revert it , if not, we'll need an RC2, which > >> is something we usually don't do (but as this could involve security, > >> we may do it). > >> The f