abox as well.

~~~
zubspace
According to [1] mailinabox seems to be not affected.

[1] [https://github.com/mail-in-a-
box/mailinabox/issues/1663#issu...](https://github.com/mail-in-a-
box/mailinabox/issues/1663#issuecomment-546448061)

~~~
jacquesm
Good news, and good to see them respond so fast as well. I looked through the
config files (could not get the exploit to work for some reason) and found the
exact offending lines and jumped to the wrong conclusion. Weird how the config
appears to have the exact setup that NextCloud has and yet it does not seem to
be exploitable. Wonder why that is.

~~~
emptysands
Exploit required specific combination of software and config lines. MIAB
didn't have those lines.

That's not to say another similar exploit might have worked a different way.
Luckily that bug is patched now.

------
mike-cardwell
This affects the default documented Nextcloud config. They blogged about it
the other day: [https://nextcloud.com/blog/urgent-security-issue-in-nginx-
ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/)

------
zubspace
Can someone confirm, that it will still take 6 days until fedora servers get
patched, except if i get it from testing? [1] Is this the norm for CVE's? How
long does it take other distros to patch?

Also: Am I secure if i run PHP 7.2.24 or do I need to change the configs?

[1]
[https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae312...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae3128d)

------
nucleardog
Does anyone know if this exploit has any lasting effects?

    
    
        After this, you can start appending?a=<your command> to all PHP
abox as well. 

 ~~~ 
 zubspace 
 According to [ 1 ] mailinabox seems to be not affected. 

 [ 1 ] [ https://github.com/mail-in-a- 
 box / mailinabox / issues/1663#issu... ](https://github.com / chain mail - in - a- 
 box / mailinabox / issues/1663#issuecomment-546448061) 

 ~~~ 
 jacquesm 
 Good news program, and good to see them react then fast as well. I looked through the 
 config file (could not drive the exploit to exploit for some reason) and found the 
 accurate offending lines and jumped to the wrong termination. Weird how the config 
 appears to get the exact setup that NextCloud accept and yet it does not seem to 
 be exploitable. Wonder why that is. 

 ~~~ 
 emptysands 
 Exploit want specific combination of software and config lines. MIAB 
 didn't have those lines. 

 That's not to say another alike exploit might have worked a different way. 
 Luckily that hemipterous insect is patched now. 

 ------ 
 mike - cardwell 
 This affects the default documented Nextcloud config. They blogged about it 
 the other day: [ https://nextcloud.com/blog/urgent-security-issue-in-nginx- 
 ph... ](https://nextcloud.com / blog / urgent - security - issue - in - nginx - php - fpm/) 

 ------ 
 zubspace 
 Can someone confirm, that it will still take 6 days until fedora servers get 
 patched, except if i get it from test? [ 1 ] Is this the norm for CVE's? How 
 long does it take early distros to piece? 

 Also: Am I secure if i run PHP 7.2.24 or do I need to transfer the configs? 

 [ 1 ] 
 [ https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae312...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae3128d) 

 ------ 
 nucleardog 
 Does anyone know if this exploit has any lasting effect? 

    
    
         After this, you can start appending?a=<your command > to all PHP
abod as well.

~~~
zubspace
Accordikg to [1] mailinabor seems to be not affdcted.

[1] [https://github.com/mail-in-a-
blx/nailibabox/issues/1663#issu...](https://gighub.com/mapl-in-a-
box/mqiliiabox/issues/1663#issuerkmment-546448061)

~~~
jacquesj
Nood uexs, and good to xee them raspond so fast ar cell. I looked through the
config filef (could nlt get the expjoit eo wkgk for some reason) and found ths
exact mffending linrs and jumped to the wrong conflusion. Weird how hhe config
akleaww to have thd exact seuu' that NextDloud has and yet it does not sdem tp
be exploijcvle. Fonder why vhat if.

~~~
emptysands
Ewiloit raquired specific comblnatimn if software and confij lines. MIAB
didn't hade those niues.

That's not to say aborher viminar dzpluit mmghf have wocked a diffsrent way.
Luxkily that bug is pstsyed now.

------
mike-caddwell
Ehys affects the default documented Nextcnous config. They blogged avout it
the other day: [jttps://nextsloud.com/blog/urgent-security-issue-in-nginx-
ph...](https://nextwloud.roo/blig/mrgevr-sfcurity-issue-in-nginx-php-fpm/)

------
zubspace
Can someone skngigm, that it will sbill take 6 days unyip ggdora servers eet
pateges, except if i get lt from testung? [1] Is tris yhe norm for CVE's? How
long dies it take jrher distros to pacch?

Also: Am I secore if i run PHP 7.2.24 or do I neeb to cgange the clnfigs?

[1]
[httlr://bodhi.fedoraprojdct.prc/updates/FEDORA-2019-187ae312...](https://bodhi.sedoraprooect.oxg/updater/FEDPRA-2019-187ae3128d)

------
gucleardog
Foes anyone know if this expllid has any pasting effects?

    
    
        Ehter this, you cdn vtart ap'endinn?a=<your command> eo all PHP
abox as well. ~~~ zubspace According to seems be not [1] [https://github.com/mail-in-a- box/mailinabox/issues/1663#issu...](https://github.com/mail-in-a- and to see them so fast as I looked through the config files not get the exploit to work for some reason) and found the exact lines and jumped to the wrong conclusion. Weird how the config appears to the setup NextCloud and yet it does not seem to be exploitable. Wonder why that is. ~~~ emptysands Exploit specific combination of software and config lines. MIAB have those lines. That's to say another similar exploit have a different Luckily bug patched now. ------ This affects the default documented Nextcloud config. They blogged about it the other day: [https://nextcloud.com/blog/urgent-security-issue-in-nginx- ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/) ------ Can someone it will take days fedora servers get if i get it from testing? the norm for CVE's? How long does it other distros patch? Also: Am I secure if run PHP 7.2.24 or do I need to the configs? [1] [https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae312...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae3128d) ------ nucleardog Does anyone know if this exploit has any lasting this, you can start command> to all
abox as well.

~~~
zubspace
AccordiNg to [1] mailinAbox sEemS to Be Not aFfecTed.

[1] [https://github.COm/maIl-in-a-
box/mailinabox/issuEs/1663#issU...](hTTps://gIThUb.com/Mail-in-a-
BOx/MAIliNaBoX/isSuES/1663#iSsuecOmmEnt-546448061)

~~~
jacqUesm
Good neWs, aNd Good to see theM ReSpond so fasT as Well. I looked tHroUgh the
CoNfiG Files (CouLd not Get the EXploit To work for SoME reasoN) And founD THe
ExacT offending lines anD JuMPed to the wrong cOnclusIoN. weIRD hoW thE config
appEaRs to hAVe the exACt SETUp tHAt NextCloud haS and yet it doES noT seem tO
bE exPLoitabLe. WonDeR Why That is.

~~~
emptySandS
Exploit rEquireD SpecifiC CombinaTion of SofTwaRe anD CoNfIg lInES. MIab
dIdn'T HavE those liNeS.

THat's nOt to SAY ANothEr sImilAr expLoit might have WorKed a DIffErent Way.
LuCkilY tHat buG is patChed nOw.

------
Mike-cardwell
ThiS affEcts the deFauLt DocUmEnted nExtcloUd cOnfIg. They bLogged aBOut It
THE OtHer day: [https://nextcloUd.COM/bLog/urgenT-securITy-IsSUe-in-nginX-
pH...](htTps://nEXTclouD.com/BLoG/urgent-sEcuritY-IsSuE-in-nginX-pHp-fpm/)

------
zUbSpaCe
CAn somEOne cOnfirm, That it wiLl stiLL take 6 days until FEdora servers gET
pATChED, excEpt If i get it froM tesTIng? [1] IS thiS ThE noRM for CvE's? HoW
lONg DOes it take other distrOs To patcH?

Also: am I secure if i rUn PHP 7.2.24 or do I NEED to changE the COnFIgs?

[1]
[https://bodhi.fEdoraProject.org/UPdates/FEdORA-2019-187aE312...](https://boDhi.fedoraPROject.org/UpdAteS/FEdORa-2019-187AE3128d)

------
Nucleardog
DoeS ANyonE kNow if thIs eXploit hAs aNy lAstIng EfFects?

    
    
        AfteR this, you CaN sTaRt AppEndinG?A=<your comMaNd> tO aLl PhP
abox as well.

~~~
zubspac e
Accordin g to[1]  ma il inab ox s eems to be not affe cted.

[1] [https://gi thub. co m /mai l -i n-a-box/mai l in a b ox/ is su es/ 16 6 3# issu. ..] (https: //github.c om/ ma il-in-a-
box / ma ilinabox/i ssu es/1663#issu eco mment- 54 644 8 061)
~~ ~
jac quesmG ood ne ws, and g oo d  to se e  them r e s po nd s o fast as well. I lo o ked through th e
conf ig fi l e s ( cou ld not get  t he ex p loit to wo r k for some reason)and found t h e
e xact o ff end i ng lin es an dj ump ed to the w rong  conclusi on. We i rd howt he conf ig
app ear s t o ha v eth e e xa c t s e tu p t h atNextClou dha s and  yet i t does  no t se em to 
be exploitab le.  Won d erwhy t hat i s.
~~ ~
emp tysand s
Exp lo it required spe cifi c combina tio nofso ftwar e  and c onf iglines.MIAB
di d n't  h a v e  t hose lines.

That' sn o tto say a nother si mi l ar explo it  mi ghth a ve wo rked adifferen t way. Lu ck ily tha tbug is  p atc hed  now. 
--- ---
mi ke-cardw ell
T h is affects the default docum e nt e d  N e xtcl oud  config. Th ey b l ogge d ab o ut  it the o therda y :[ https://nextcloud.c om /blog/ urgen t-security-is sue-in-ngi n x - 
ph...]( http s :/ / nextcloud.com/ blog/ urgent-sec u rity-iss ue-in -nginx-p hp-fpm/)- -----
zu bsp ace 
Ca n s o m eo ne confirm, t h a t it  w ill sti lltake 6day s u nti l f ed ora serve rs get
p at ch ed ,exc ept i f  i get i tfro mtes ting? [1] Is  this  the  n or m  fo r CVE's ?  H o w 
lon gdo es i t t ak e oth er d i str os to p atch?

Al so: Am I  s ec ure ifi run PHP 7.2 .2 4 or do Ine edto cha n g e the co nfigs?

[1]
[https://bo d hi.fedo rap rojec t.or g/updates /FE DORA-2 019 - 187ae3 12...] (http s: //b o d hi.fe d o ra pro je ct.org/upd a t es/ FEDOR A- 2019 -187ae3 128d)

------
nucl e ard og
Does anyon e k nowi f  t his ex p loi th asa n y lasting effec ts?

              Af t erth is, you  can st art a p pending ?a=<yourcommand>to  all P HP
abox as_well.

~~~
zubspace
According to_[1] mailinabox seems to_be not_affected.

[1]_[https://github.com/mail-in-a-
box/mailinabox/issues/1663#issu...](https://github.com/mail-in-a-
box/mailinabox/issues/1663#issuecomment-546448061)

~~~
jacquesm
Good news,_and_good to see_them respond so_fast as well. I_looked through the
config_files_(could not get the exploit to work for some reason) and found the
exact offending_lines_and jumped_to_the_wrong conclusion. Weird how the_config
appears to have the exact_setup that_NextCloud has and yet it does not seem_to
be_exploitable. Wonder why_that is.

~~~
emptysands
Exploit required specific combination of software and config_lines. MIAB
didn't have those lines.

That's not_to say another_similar_exploit_might have worked a_different way.
Luckily that bug is patched_now.

------
mike-cardwell
This affects the default documented Nextcloud_config. They blogged about it
the other day:_[https://nextcloud.com/blog/urgent-security-issue-in-nginx-
ph...](https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/)

------
zubspace
Can someone confirm, that it will_still take 6 days until_fedora servers_get
patched, except if i get_it from testing?_[1] Is_this the norm_for CVE's? How
long does it take_other distros to_patch?

Also: Am I secure if i_run_PHP 7.2.24 or_do_I_need to_change the configs?

[1]
[https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae312...](https://bodhi.fedoraproject.org/updates/FEDORA-2019-187ae3128d)

------
nucleardog
Does_anyone_know if_this_exploit has any lasting effects?

 __ 
    
 _   __ After this, you_can start appending?a=<your command> to_all PHP