Menu ▾ ▴

#472 Switch PHP minimum version to 8.1

6.9.1
closed
Stéphane Aulery
None
Unknown
Upkeep
8.1
Unknown
Unknown
Unknown
2024-04-14
2022-05-04
Stéphane Aulery
No

Should be done when 8.4 will be released (End of year 2024).

Depending on the severity of the CVEs corrected by PHP 8.2 and PHP 8.3, accelerate the minimum version upgrade.

PHP 8.3.6

Standard:

    Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
    Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
    Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)

PHP 8.2.18

Standard:

    Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
    Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
    Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)

Related

News: 2024/04/wikindx-v691

Discussion

  • Stéphane Aulery

    Stéphane Aulery - 2024-04-12
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -1 +1,22 @@
 Should be done when 8.4 will be released (End of year 2024).
+
+Depending on the severity of the CVEs corrected by PHP 8.2 and PHP 8.3, accelerate the minimum version upgrade.
+
+PHP 8.3.6
+~~~
+Standard:
+
+    Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
+    Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
+    Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
+~~~
+
+
+PHP 8.2.18
+~~~
+Standard:
+
+    Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
+    Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
+    Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
+~~~
    • status: open --> need-info
    • Database: Unknow --> Unknown
    • OS: Unknow --> Unknown
    • Release cycle: --> Unknown
     

  • Stéphane Aulery

    Stéphane Aulery - 2024-04-14
    • status: need-info --> closed
    • Target: Unknown --> 6.9.1
     

Log in to post a comment.