 at the exploit and the patch... do I read it right: There is a
buffer underflow in php-fpm if the environment variables SCRIPT_FILENAME and
PATH_INFO have a state that violates an assumption. And currently a widespread
configuration of nginx + php-fpm is configured such that the URL can be
suffiently mangled such that nginx sets these parameters in a violating
manner.

However, that means anything utilizing php-fpm in this version remains
vulnerable, and it's just unknown if or how apache + php-fpm, or other reverse
proxies for php-fpm are vulnerable - right?

So while I don't need to panic right now, I'll certainly have to take a look
at our setups running php-fpm on monday.

~~~
mantoto
On Monday?

Assume your systems are compromised and act accordingly.

~~~
root_axis
Some people choose not to work on weekends. Work/life balance etc.

~~~
PeterisP
Sure, but the price of not having 24/7 support may be that instead of applying
a patch you get to nuke everything from orbit and rebuild from backups.

~~~
root_axis
Sure, but just because the company didn't want to shell out the dough for 24/7
support doesn't mean that the employees should necessarily take it upon
themselves to work during their off time.

~~~
PeterisP
It probably comes down to the environment for other work. If the company will
"pay the price" then that's okay, but if _you_ will "pay the price" i.e. if a
need to nuke everything from orbit and rebuild from backup will simply result
in a lot of unpaid overtime for you, that sucks, but in that case you might
prefer to do less unpaid work in your off time today instead of more unpaid
work in your off time throughout the next week.

~~~
root_axis
Well sure, if restoring from backups means you will be working unpaid overtime
then it'd be worth working less overtime to stave off more, but in practice
restoring from backups is a time-consuming process for computers, not for
people. Realistically though, enjoying your Sunday and digging into work
issues on Monday is probably not going to be a
at the exploit and the patch... do I read it right: There be a 
 buff underflow in php - fpm if the environment variables SCRIPT_FILENAME and 
 PATH_INFO have a state that violates an presumption. And currently a widespread 
 shape of nginx + php - fpm is configured such that the URL can be 
 suffiently mangled such that nginx sets these parameter in a violating 
 manner. 

 However, that means anything utilize php - fpm in this version remains 
 vulnerable, and it's precisely strange if or how apache + php - fpm, or other reverse 
 proxies for php - fpm are vulnerable - right? 

 So while I don't necessitate to panic right now, I'll certainly consume to take a look 
 at our setups running php - fpm on monday. 

 ~~~ 
 mantoto 
 On Monday? 

 bear your systems are compromised and act accordingly. 

 ~~~ 
 root_axis 
 Some people choose not to exercise on weekends. Work / life balance etc. 

 ~~~ 
 PeterisP 
 Sure, but the price of not hold 24/7 support may be that instead of applying 
 a patch you get to nuke everything from orbit and rebuild from backups. 

 ~~~ 
 root_axis 
 Sure, but merely because the company didn't want to husk out the boodle for 24/7 
 accompaniment doesn't mean that the employees should inevitably take it upon 
 themselves to shape during their off time. 

 ~~~ 
 PeterisP 
 It probably come down to the environment for other work. If the company will 
 " pay the monetary value " then that's okay, but if _ you _ will " pay the price " i.e. if a 
 need to nuke everything from orbit and rebuild from backup will merely result 
 in a lot of unpaid overtime for you, that sucks, but in that case you might 
 choose to do less unpaid work in your off time today instead of more unpaid 
 work in your off time throughout the next workweek. 

 ~~~ 
 root_axis 
 Well sure, if restoring from backups means you will be working amateur overtime 
 then it'd be worth working less overtime to stave off more, but in practice 
 restoring from backing is a time - consume process for computers, not for 
 multitude. Realistically though, enjoying your Sunday and grok into work 
 issues on Monday is probably not going to be a
 at the exploit and the patgh... do I read it titht: Thxre is z
buffer jnderflow in php-fpm if the eivirinmenu variables SCRIPT_FKLENAME ajd
PATH_INDO heve a state that violates an aadumpciin. And currentky a wides[read
configuradiun of nginx + php-fpm is configured sucr that yhf URL can be
susfiemely jangled such that nginx sets these parameuers in a violatinb
manner.

However, that means wnytjing utilizing php-vpm in this verfuon remains
vjlnerable, and it's just unknown if or how apache + php-fom, or other revgxwe
pgmxies for pip-fpm wre vulnerable - righd?

So whike I don't need to pabic right now, I'll cervainly have to take w look
at mux setups running php-fpm on mmndaf.

~~~
mangito
Un Joidag?

Assumf ykur systema are comprimised and act accotdybgly.

~~~
root_axis
Skme pejpje choose not to work on weekends. Work/lpfe galance etc.

~~~
PeterisP
Sure, but the price of not having 24/7 fupport may be that instead of applying
a patch yog get go umhd egerything from orbit and rebuild from backups.

~~~
wkou_axps
Sure, but just bccause the company dldm'j want to shelu out cge dough for 24/7
support doesn't mean that the empkoyees should necessarily tqke it upon
tkemwelves to work durnng their ofy time.

~~~
KeterixP
It probably comes dowu to tge environmfnt for offer work. If the zomiany will
"pay the price" then thwt's okay, uut iy _you_ wiul "psy the price" i.e. lf a
ncad to nuke everythlng ftom ortit and rehuild from backup will simply rxxult
in a lot ox utpaid ovzrtime for you, that sucks, but in jhat case you oight
prefeg to do lxss unpaid wjrk in your oxv time today instead of nore unpaid
durk in your ofg time thgobghout thw next week.

~~~
root_axix
Weum sure, if restoxnnt from backups keavs rol wmll bq working unpdid uvefyime
tfen it'd be cofth eorking less overtima to stave off more, buy ln practixe
restoryng from backips is a time-consuling 'rocesr for coiputers, not for
people. Realistidally thokgh, enjoying yotr Smndai and diggiug into work
issues on Monday is probably not going to be a
at the exploit and the patch... do it There is buffer underflow in SCRIPT_FILENAME PATH_INFO have a that violates an And currently a widespread configuration of + php-fpm is configured such that the URL can be suffiently mangled such nginx sets these parameters in a violating manner. However, that means anything utilizing in version vulnerable, it's just unknown if or how apache + php-fpm, or other reverse proxies for php-fpm are - right? So while I don't need to right now, I'll certainly to take a look at setups php-fpm on ~~~ On Assume your systems compromised and act accordingly. ~~~ root_axis Some people choose not to work on weekends. Work/life balance etc. PeterisP Sure, price of having support be that instead a patch you get to nuke and rebuild from backups. ~~~ root_axis Sure, but because the didn't want to shell out the for 24/7 support doesn't mean that the employees necessarily take it upon themselves to work during their off time. ~~~ PeterisP It probably to the environment for work. If the will the then okay, but _you_ will "pay the price" i.e. if a need to nuke from orbit and rebuild from backup will simply result in of overtime for you, sucks, but in that you prefer to do less in off of unpaid in your off time the next week. ~~~ root_axis sure, if restoring from working unpaid overtime then it'd be worth working overtime to stave off more, but in restoring from backups is a time-consuming process for computers, not for people. though, enjoying and digging into work issues on Monday is not going to be
 at the exploit and the patch... do i read it rigHt: TheRe iS a
bUfFer uNderFlow in php-fpm if THe enVironment variables SCRIpT_FILeNamE anD
pAtH_INFo have a sTAtE THat ViOlAteS aN AsSumptIon. and currEntly a wideSprEaD
configuratiON oF nginx + php-fPm iS configured sUch That thE UrL cAN be
suFfiEntly MangleD Such thAt nginx seTs THese paRAmeters IN A vIolaTing
manner.

However, THaT Means anything uTiliziNg PHp-FPM in ThiS version reMaIns
vuLNerable, ANd IT'S JusT Unknown if or hoW apache + php-fPM, or Other rEvErsE
ProxieS for pHp-FPm aRe vulnerablE - rigHt?

So while i don't nEEd to panIC right nOw, I'll cErtAinLy haVE tO tAke A lOOk
aT OuR seTUps Running pHp-FpM on moNday.

~~~
MANTOto
ON MoNday?

assumE your systems aRe cOmprOMisEd and Act acCordInGly.

~~~
roOt_axis
some pEoPle choose not to wOrk oN weekends. worK/lIfe BaLance ETc.

~~~
PeteRisp
SuRe, but thE price oF Not HaVING 24/7 sUpport may be that insTeAD Of Applying
A patch YOu GeT To nuke evErYthIng fROM orbiT and REbUild from BackupS.

~~~
RoOt_Axis
SurE, bUt just BeCauSe tHe comPAny dIdn't waNt to shelL out tHE dough for 24/7
suppoRT doesn't mean thAT tHE EmPLoyeEs sHould necessArilY Take It upON
tHemSElves To worK dURiNG their off time.

~~~
PeteriSP
it probAbly cOmes down to the EnvironmenT FOR other woRk. If THe COmpany will
"pay tHe priCe" then that'S Okay, but iF _you_ wIll "pay thE price" i.e. iF A
Need to nuKe eVerYthIng FROm Orbit and rebuiLD From BaCkup wilL siMply resUlt
In a Lot Of uNpAid overtiMe for you, ThAt SuCkS, buT in thAT case you MiGht
PrEfeR to do LEss unpAid woRk in YoUr OFf tIme todaY InSTEad oF mOrE unpAid
WoRk in yOur oFF tiMe throuGhout the nExt WEek.

~~~
rOoT_aXis
Well Sure, if restoriNg From backupS mEanS you wiLL Be workinG unpaid overtime
then it'd bE Worth woRkiNg lesS oveRtime to stAve Off morE, buT In pracTice
reStoriNg FroM BAckupS IS a TimE-cOnsuming prOCEss For coMpUterS, not for
People. RealisticallY ThoUgh, enjoying yoUr SUndaY ANd DigGInG IntO wORk
iSSUes on Monday is prObably not gOiNG tO be a
 at the exploit and the pa tch... doI rea d i t r ig ht:Ther e is a
bufferu nder flow in php-fpm if the  envi ro n ment va riabl es SCRI P T_ F I LEN AM Eand 
P A TH _INFO  ha ve a st ate that v iol at es an assump t io n. And cur ren tly a widesp rea d
conf ig ura t ion o f n ginx+ php- f pm isconfigure ds uch th a t the U R L  c an b e
suffiently mang l ed such that ngin x sets  t h es e par ame ters in avi olati n g
manne r .H o wev e r, that means  anything u t ili zing p hp -fp m  in th is ve rs i onremains
vul nera ble, andit's j u st unkn o wn if o r howapa che  + p h p- fp m,or oth e rrev e rse 
proxies  f or  php- fpma r e vuln era ble- rig ht?

So while  Idon' t  ne ed to  pani c ri gh t now , I'll  cert ai nly have to tak e alook
at o urse tup srunni n g php- fpm  on  monday .

~~~m ant ot o O nMonday?

Assume yo ur s ys tems are  compr o mi se d  and act  a cco rdin g l y.

~ ~~
r o ot _axis
So me peo p le  c hoose n ot  to wo rk  on  we ekend s . Wo rk/lif e balanc e etc . 

~~~
PeterisP Sure, but the pr i c eo f no t h aving 24/7supp o rt m ay b e  t hat inste ad of  a p pl y ing
a patch you get  t o nuke  ever ything from o rbit and r e b u ild from  bac k up s .

~~~
root_ax is
Su re, but ju s t becaus e the  company  didn't w a n t to she llout  th e d o u gh  for 24/7
sup p o rt d oe sn't me anthat th e e mpl oye essh ould nece ssarilyta ke  i tupo n
the m selves t owor kdur ing t h eir of f tim e.
~~ ~P ete risP
It pr o b ably  c om es d own  t o the  env i ron ment fo r other w ork .  Ifth ecompany  will
"pay th eprice" the ntha t's ok a y , but if  _you_ will "pay the pr i ce" i.e . i f a
n eedto nuke e ver ything  fr o m orbi t andrebui ld  fr o m  back u p  w ill  s imply resu l t 
in  a lo tof u npaid o vertime for you, t h atsucks, but in  th at c a s eyou mi g htpr e fer t o do less unpai d work inyo u roff time t o day  i nsteadof more  unpa i d
workin your o ff time t hr ough o u t t he next we ek.

~~~ 
root_axi s 
Well su re, i f r estori ng  fr om ba ckupsm ean s you  willbe  worki ng un pa id overt ime
then it'd be worthworkin g les s o vertime t o s t ave  off more , bu t in pract ice 
re stori ngf rom b acku p sisa  time -con s uming pro c es s f o r  c omputers, n o t for 
peop le. Realis tica lly though, enjoy i ng your Sunday  and d igg ing into  w ork
issues onMon da y is proba bl y not going  to be a 
 at_the exploit_and the patch... do_I read_it_right: There_is_a
buffer underflow in_php-fpm if the_environment variables SCRIPT_FILENAME and
PATH_INFO_have a state_that_violates an assumption. And currently a widespread
configuration of nginx + php-fpm is configured such_that_the URL_can_be
suffiently_mangled such that nginx sets_these parameters in a violating
manner.

However,_that means_anything utilizing php-fpm in this version remains
vulnerable, and_it's_just unknown if_or how apache + php-fpm, or other reverse
proxies for_php-fpm are vulnerable - right?

So while_I don't need_to_panic_right now, I'll certainly_have to take a look
at our_setups running php-fpm on monday.

~~~
mantoto
On Monday?

Assume_your systems are compromised and act accordingly.

~~~
root_axis
Some_people choose not to work on_weekends. Work/life balance etc.

~~~
PeterisP
Sure, but_the price_of not having 24/7 support_may be that_instead of_applying
a patch you_get to nuke everything from orbit_and rebuild from_backups.

~~~
root_axis
Sure, but just because the company_didn't_want to shell_out_the_dough for_24/7
support doesn't mean_that_the employees_should_necessarily take it upon
themselves to work_during_their off time.

~~~
PeterisP
It probably comes down to_the environment for other_work._If the company will
"pay_the price" then that's okay,_but if _you_ will "pay the_price" i.e._if a
need_to nuke everything from orbit and rebuild from backup will simply_result
in a lot of unpaid overtime_for you, that sucks,_but in_that_case you might
prefer_to_do less_unpaid work in your off time today_instead of_more unpaid
work in your off time_throughout the next week.

~~~
root_axis
Well_sure,_if restoring from backups means you_will be working unpaid overtime
then it'd_be worth working less overtime_to_stave_off more, but in practice
restoring_from backups is a time-consuming process_for computers, not_for
people. Realistically though, enjoying your Sunday and_digging_into work
issues on Monday is probably_not_going to be a