From unknown Tue Jun 24 22:35:34 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#27993 <27993@debbugs.gnu.org> To: bug#27993 <27993@debbugs.gnu.org> Subject: Status: Oniguruma (PHP and Ruby) security issues Reply-To: bug#27993 <27993@debbugs.gnu.org> Date: Wed, 25 Jun 2025 05:35:34 +0000 retitle 27993 Oniguruma (PHP and Ruby) security issues reassign 27993 guix submitter 27993 Leo Famulari severity 27993 normal tag 27993 security thanks From debbugs-submit-bounces@debbugs.gnu.org Sun Aug 06 16:29:52 2017 Received: (at submit) by debbugs.gnu.org; 6 Aug 2017 20:29:52 +0000 Received: from localhost ([127.0.0.1]:44998 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1deSBM-0007pk-0a for submit@debbugs.gnu.org; Sun, 06 Aug 2017 16:29:52 -0400 Received: from eggs.gnu.org ([208.118.235.92]:37227) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1deSBJ-0007pU-NG for submit@debbugs.gnu.org; Sun, 06 Aug 2017 16:29:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1deSBD-0005S3-7H for submit@debbugs.gnu.org; Sun, 06 Aug 2017 16:29:44 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:39718) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1deSBD-0005Rz-49 for submit@debbugs.gnu.org; Sun, 06 Aug 2017 16:29:43 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56430) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1deSBB-0003vg-IP for bug-guix@gnu.org; Sun, 06 Aug 2017 16:29:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1deSB7-0005Q5-2x for bug-guix@gnu.org; Sun, 06 Aug 2017 16:29:41 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:57643) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1deSB6-0005Pr-PE for bug-guix@gnu.org; Sun, 06 Aug 2017 16:29:37 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id 0CC4821676; Sun, 6 Aug 2017 16:29:35 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Sun, 06 Aug 2017 16:29:35 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=88d ANtf5HcMetloy27WBf73hrBu0LCdrmqQuexDnLhU=; b=RmDj0AmjEsD5cQJHtbM vGeEJ26c7C7HPTUBZz9HIcjKgk/zgJDWdedXQe83uOoKgWEc5gwkOrosbBTPVk+P ljSFYg82ULr5EUh9I2JDTYgafzWlF34QS8lHyJuoOqh2Li2VJHhQeBgSmZtjnRDh Ubr6F7UKa/RK65LrIF+wWyrM= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=fm1; bh=88dANtf5HcMetloy27WBf73hrBu0LCdrmqQuexDnL hU=; b=RUEWhnnzjIOw+jMQsl22SsPirxxkToOxiDYYfWVx8+NUpyAZhtbD0Y8Dy d/Ule6UiwvNhbjwbxNp8vYs2tjx1/iev9F21t9GEu4aLj6nAEiyVgzzwbA88Udco PekNiJp5NEmaMdpR+C00x+aXJWAD+9mIwtrax0cLZibMsI7H20t7o3o0/IBEN3m5 vbrXOj5zfPeeI9WZjozn9cne9TzAQ2YZLUEoee5YTh2IxkZl97IPnCirF1rtjszF MSIaWcBxw+jh00CUU0PAFZ+yk9n4jCxbivlNvj2654tr858YzYPc5JtIjB1cw5XU D92kQDUOkiN4E3WCw0tcSG5SbVBAQ== X-ME-Sender: X-Sasl-enc: s7sdA06rHZaJIsDU+vZoZmaxmEhOVkg11P0er2N0eh/2 1502051374 Received: from localhost (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id BB145245B0 for ; Sun, 6 Aug 2017 16:29:34 -0400 (EDT) Date: Sun, 6 Aug 2017 16:29:33 -0400 From: Leo Famulari To: bug-guix@gnu.org Subject: Oniguruma (PHP and Ruby) security issues Message-ID: <20170806202933.GA21954@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="nFreZHaLTZJo0R7j" Content-Disposition: inline User-Agent: Mutt/1.8.3 (2017-05-23) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.1 (----) --nFreZHaLTZJo0R7j Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Recently several serious bugs were fixed in Oniguruma, CVE-2017-{9224,9225,9226,9227,9228,9229}: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=oniguruma https://github.com/kkos/oniguruma#fixed-security-issues I'm not sure exactly which Oniguruma release fixed the bugs. Ruby includes vulnerable code from Oniguruma. I didn't see any fixes in the Ruby Git repo. I tried building PHP with Oniguruma 6.4.0 or 6.5.0 but the PHP test suite fails like this: ===================================================================== FAILED TEST SUMMARY --------------------------------------------------------------------- Bug #72994 (mbc_to_code() out of bounds read) [ext/mbstring/tests/bug72994.phpt] Test mb_ereg_replace() function : usage variations - [ext/mbstring/tests/mb_ereg_replace_variation1.phpt] Test mb_ereg() function : usage variations - pass different character classes to see they match correctly [ext/mbstring/tests/mb_ereg_variation3.phpt] ===================================================================== I tried using the bundled Oniguruma, which includes the fixes, and it fails like this: ===================================================================== FAILED TEST SUMMARY --------------------------------------------------------------------- Bug #60120 proc_open hangs with stdin/out with 2048+ bytes [ext/standard/tests/streams/proc_open_bug60120.phpt] ===================================================================== --nFreZHaLTZJo0R7j Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlmHfCoACgkQJkb6MLrK fwhX5Q/7B9UUCPVzQ6B5R7p4wWnkm1/q3PnBeA2yVxLRpUTskXjmft3mKjf5P8GA KXvGWRI99AgFPGk6ZQ0wNcbNewADrQJbANrWAPMgyQq/cLutbv4zjHyd3LR6vh6p l6jgbyqw3jIl9jxPPt6/tkB3TcGvfZQHyWzMtTOWNzUBesAWu16Q2VeFVN20GSmI DJCkkzfThxzAl5QRXij6rU0vlQSdskS52oVCaoiyIX7K8hqFer0ATFMVJEbZ4udx nq3bf2OTZijJpOVugEkv8RW2kNa77+blz6LqoLjCondWxdzoAmHwsWtTyADnAtv+ EqAXbmr72i/XkkIUISG/XlTyQ4w2IpHglq34Fk6OLD+awvo8/NMeNR4sRY6W52AQ 2gRY5ke+RpbwEYJnWCNWyakmp/S7FMqDg/1LrgU8bK+SlAnjUryS37AL1XWxSoRz cp+KEAZglgKRl+o0amT5/w7s/aoQMaV2SB8BAi9ubQnar/WkDSzz9ePxEAMUHHsk NMuCdcBAXLLpn0OKvyMFZl7by0fHqZp7OdTpYsbgHbnTvJIOqb9vons5q+MBsU3D 70+cRDXMuffTTEB0rDoas3eQwuJOzQS03OJK4ZGT6O1BLjtbdYntt9jh3Dpv1xUZ MvI+yy1M6DnP+Xi28NZlfcK+JG8NQSDvty99MVCCPKb895sKnMw= =NSuc -----END PGP SIGNATURE----- --nFreZHaLTZJo0R7j-- From debbugs-submit-bounces@debbugs.gnu.org Fri Sep 08 04:33:23 2017 Received: (at control) by debbugs.gnu.org; 8 Sep 2017 08:33:23 +0000 Received: from localhost ([127.0.0.1]:55240 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dqEj5-0008Ph-46 for submit@debbugs.gnu.org; Fri, 08 Sep 2017 04:33:23 -0400 Received: from eggs.gnu.org ([208.118.235.92]:41439) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dqEj3-0008PT-CD for control@debbugs.gnu.org; Fri, 08 Sep 2017 04:33:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dqEit-0001J9-FD for control@debbugs.gnu.org; Fri, 08 Sep 2017 04:33:16 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:43053) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dqEit-0001J1-CL for control@debbugs.gnu.org; Fri, 08 Sep 2017 04:33:11 -0400 Received: from [193.50.110.231] (port=57868 helo=ribbon) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1dqEis-0005Ma-L3 for control@debbugs.gnu.org; Fri, 08 Sep 2017 04:33:11 -0400 Date: Fri, 08 Sep 2017 10:33:09 +0200 Message-Id: <87lglpk2t6.fsf@gnu.org> To: control@debbugs.gnu.org From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: control message for bug #27993 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) tags 27993 security From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 25 21:08:37 2019 Received: (at 27993-done) by debbugs.gnu.org; 26 Feb 2019 02:08:37 +0000 Received: from localhost ([127.0.0.1]:52035 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gySAe-0001KQ-M7 for submit@debbugs.gnu.org; Mon, 25 Feb 2019 21:08:37 -0500 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:50391) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gySAd-0001KE-24 for 27993-done@debbugs.gnu.org; Mon, 25 Feb 2019 21:08:35 -0500 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id F32992234C; Mon, 25 Feb 2019 21:08:29 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute4.internal (MEProxy); Mon, 25 Feb 2019 21:08:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:to:subject:message-id:references:mime-version :content-type:in-reply-to; s=mesmtp; bh=Fa19vQmcW9z+foDbuCKAq70M 4miO/AD4jTsRO3yKuas=; b=lRj6irmpEM2FUBpa3gOneFKkAGIpgHJN/bpXCNKJ judIVsRZ2QaYpSaDVsWImkZH7UB7VpBwwTG3RzCpCkMeRTWl3/1eUGoJjAXOAdio gIgkfunFWVbgY16f8/1ey/cqS6kN8M2Un4DjzKPspcmOFyon6+u4gY45XBrxu1Mc LTs= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=Fa19vQ mcW9z+foDbuCKAq70M4miO/AD4jTsRO3yKuas=; b=rD+J2s4mU08GBzL+fXR5lb +sD+vZWLXcCo5tgVnX8sCiqep9hLyK3fTUxd6p9ht6J9GcnpMBrsB1TOpWrfaXBk jDt6deFmea74WVeDPoBNs5sSCqNmZvMWaSSyi6ZGRS89guhRR/ljVPFlaPGvy16X isA98+q6G+I+sAG30uVzAXOirTbZvh4EmJzPLMMZJRNrbFr2bZz2UJ/0ZteHrMBO wiQjjFyC72yzkY/cOEccU/545KWp8kIC66fP/hAsjtzu3AKMasAl29YiuaOxsxdY AbWYeGrYcwo1gw+H++7Pwl2dta8TrnVU5muEAbsb8tR5/kXE4C8dr142sOhL/sPg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrudekgdegfeculddtuddrgedtledrtddtmd cutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfhuthen uceurghilhhouhhtmecufedttdenucenucfjughrpeffhffvuffkfhggtggujggfsehgtd erredtredvnecuhfhrohhmpefnvghoucfhrghmuhhlrghrihcuoehlvghosehfrghmuhhl rghrihdrnhgrmhgvqeenucfkphepjeeirdduvdegrddvtddvrddufeejnecurfgrrhgrmh epmhgrihhlfhhrohhmpehlvghosehfrghmuhhlrghrihdrnhgrmhgvnecuvehluhhsthgv rhfuihiivgeptd X-ME-Proxy: Received: from localhost (c-76-124-202-137.hsd1.pa.comcast.net [76.124.202.137]) by mail.messagingengine.com (Postfix) with ESMTPA id 8513110331 for <27993-done@debbugs.gnu.org>; Mon, 25 Feb 2019 21:08:29 -0500 (EST) Date: Mon, 25 Feb 2019 21:08:28 -0500 From: Leo Famulari To: 27993-done@debbugs.gnu.org Subject: Re: Oniguruma (PHP and Ruby) security issues Message-ID: <20190226020828.GA26247@jasmine.lan> References: <20170806202933.GA21954@jasmine.lan> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="GvXjxJ+pjyke8COw" Content-Disposition: inline In-Reply-To: <20170806202933.GA21954@jasmine.lan> User-Agent: Mutt/1.11.3 (2019-02-01) X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 27993-done X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.7 (-) --GvXjxJ+pjyke8COw Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Sun, Aug 06, 2017 at 04:29:33PM -0400, Leo Famulari wrote: > Recently several serious bugs were fixed in Oniguruma, > CVE-2017-{9224,9225,9226,9227,9228,9229}: [...] > I'm not sure exactly which Oniguruma release fixed the bugs. I'm still not sure, but our PHP package is using the latest Oniguruma, and a lot of time has passed since this bug was opened. Closing... --GvXjxJ+pjyke8COw Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlx0n5wACgkQJkb6MLrK fwjKFxAAkuMQQl0Bz5ln6DUwBrc4uBVz7jGQ1W4JIWuVmen0h+th1EXzb/6ys88W vVsFkLGGCG7UNS/z9d5WI+NE4WYvRoUjfWrZQQvzUlvWixGyQ2Wqt7Cyw0zhi0Df S/zFxs0d3fRWci5I0ibwDjzt5UQb1D5V3/xJdz4NlS+dAYOzE9pd7Fc5KJiMyb/+ 4xnVdB3F9Hf6lmf6yKvQLJO8FsHUyCSUSGJktNXJnTb8dOWlcv3fTxQYqoDhOwP6 q53+Ro9+R0DShrx5UQ0XbIH/REWH2H1UIwOj6+r0ZmH9/s0CUrMu+I5G4Q10O2zT GZXFu9zVW04QB1Nif4YQVOmRsXc8dsNYnLmP5U2XRy1hJbDNwz/lKSwps3LxVs0c IBemIZpSc7c8jAOkVWmbhmKYeUqRX7V447Ml9CfYvHMZ2ObcBlfIE43RB7EZ5NoE aqHuYWRh5h6RdvlA0zvUvhpwjiLPdOgD4UkBGI8ydNN/sGXwZvYcnkyXBOv02PA6 QFCnILimMXeRF0DJC1xWpHHABXytDj2Vpi24QZlpOaXS5ZGyGEeSsq8nYvGbouqX vITmOeASVCYPYCbruWgajbjYqwEjM72Lxv8GaBXrSRAGDxLS6EWGLnhgg8SwNy+l pIPvJpoKdrf+9CRW3GX95JEIUTmNX2CcTtLU56R/Ch4HKWrLLH0= =NuR+ -----END PGP SIGNATURE----- --GvXjxJ+pjyke8COw-- From unknown Tue Jun 24 22:35:34 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Tue, 26 Mar 2019 11:24:08 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator