I am talking about the PHP 5.3.3 package that is available in the Red Hat Enterprise Linux repository, running on Apache. From what I can see, as of RHEL 6, it is the latest version (no updates available). I assume security patches are backported, so my question is, with all other things being equal: Is this package less secure than if I had downloaded and compiled the latest stable release from the PHP site?
4
-
Yes, very: cvedetails.com/vulnerability-list/vendor_id-74/product_id-128/…– Django ReinhardtCommented Mar 15, 2017 at 17:31
-
@DjangoReinhardt, that link is not very helpful since it does not differentiate vulnerabilities that RedHat has patched vs. those it has not.– Jacob BrownCommented Jul 19, 2017 at 17:06
-
@JacobBrown Fair point. Any fixed patched by RHEL will not be included on that list... but you're still trusting that they've tackled them all.– Django ReinhardtCommented Jul 19, 2017 at 17:19
-
@DjangoReinhardt, it's a good link, just seems tangential to the question, which very clearly asks about the RHEL6-patched 5.3.3. Also, I don't trust that they've tackled them all, and I suspect the answer below identifies a real problem.– Jacob BrownCommented Jul 19, 2017 at 17:44
Add a comment
|
1 Answer
Please take below-mentioned as my personal opinion.
I think is is less secure. But it depends on what you consider a security problem and what not.
real life example
my company reported a few security issues to PHP. They have fixed it in latest release of 5.5.x ..
I'm not even going to get into they have forgotten to fix it on 5.4.x tree and haven't released an updated version for 5.4.x even after my emails.
The bug report for one of them is here: https://bugs.php.net/bug.php?id=67538
Red Hat bugzilla for it is here: https://bugzilla.redhat.com/show_bug.cgi?id=1120266
Red Hat does not really consider this a security problem even if it affects quite a few shared hosting environments - as they say open_basedir, disable_functions and similar "protections" (that can be bypassed using above-mentioned bug(s)) are not real protections and should not be taken so.
Having said that - it's only up to you to decide whether it even make sense to somehow assume PHP provides some security features.
In my opinion your environment should be configured in a way that even if someone compromises a site and gains access to PHP they won't be able to do much more than just messing with that one site and nothing else.
One more answer I gave on stackoverflow might become handy in considerations.
edit: none of the issues we've reported to PHP weeks ago have been fixed in RHEL so far - that's what I based my opinion on.
