漏洞版本:

PHP 5.3.27

PHP 5.4.17

PHP 5.5.1

漏洞描述:

Bugtraq ID:61776

PHP是一种HTML内嵌式的脚本语言

PHP SSL模块不正确处理服务器SSL证书中"subjectAltNames"通用名中的空字节，允许攻击者利用漏洞进行中间人攻击，获取敏感信息

安全建议:

厂商解决方案

用户可参考如下厂商提供的安全补丁以修复该漏洞：

http://git.php.net/?p=php-src.git;a=commit;h=dcea4ec698dcae39b7bba6f6aa08933cbfee6755

http://git.php.net/?p=php-src.git;a=commit;h=2874696a5a8d46639d261571f915c493cd875897

http://git.php.net/?p=php-src.git;a=commit;h=2b9f5ac2525118bab372d5fc66eb19cabc46f483

PHP SSL Module "subjectAltNames"空字节处理安全绕过漏洞的更多相关文章

  1. Nginx %00空字节执行php漏洞

    Nginx如下版本:0.5.*, 0.6.*, 0.7 <= 0.7.65, 0.8 <= 0.8.37在使用PHP-FastCGI执行php的时候,URL里面在遇到%00空字节时与Fas ...

  2. pip cannot confirm SSL certificate: SSL module is not available

    centos6.8编译安装python2.7之后,使用pip报错:pip cannot confirm SSL certificate: SSL module is not available 解决方 ...

  3. pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.

    # 背景 安装pip后发现执行pip install pytest,提示下面错误 pip is configured with locations that require TLS/SSL, howe ...

  4. python3.6 SSL module is not available

    pip is configured with locations that require TLS/SSL, however the ssl module in Python is not avail ...

  5. the ssl module in Python is not available错误解决

    在使用pip安装pymongo的过程中报错,提示如下: $ pip3 install pymongo pip is configured with locations that require TLS ...

  6. centos7中python3.6报错ModuleNotFoundError: No module named '_ssl' 或者 Max retries exceeded with url: / (Caused by SSLError("Can't connect to HTTPS URL because the SSL module is not available.",))

    如果在运行爬虫时报此错:requests.exceptions.SSLError: HTTPSConnectionPool(host='www.baidu.com', port=443): Max r ...

  7. pip install 时报错 pip is configured with locations that require TLS/SSL, however the ssl module in Python is not available.

    pip install 时报错: pip is configured with locations that require TLS/SSL, however the ssl module in Py ...

  8. Caused by SSLError("Can’t connect to HTTPS URL because the SSL module is not available)

    window7系统: 今天刚安装的anaconda(开源的Python包管理器),把原来的python3和python2都给卸载了,结果运行爬虫程序的时候报错: Caused by SSLError( ...

  9. centos6.8安装python3.7.3报错Can't connect to HTTPS URL because the SSL module is not available问题解决

    环境:CentOS release 6.8 (Final) # 直接编译python3.7在使用pip3安装依赖的时候报错: Can't connect to HTTPS URL because th ...

随机推荐

  1. Linux下安装GAMS建模优化工具

    1.下载GAMS wget http://d37drm4t2jghv5.cloudfront.net/distributions/24.5.6/linux/linux_x64_64_sfx.exe 2 ...

  2. HDU-4593(水题)

    Robot Problem Description A robot is a mechanical or virtual artificial agent, usually an electro-me ...

  3. tp集成支付宝担保支付

    现在的网站功能越来越全乎了,很多网站都需要做支付功能,而且很多大平台都提供了各式各样的api来扩充自己的用户和开发者.话说,这种使用大平台的api来做支付,无论是从成本上还是从开发效率上都是很好的选择 ...

  4. webrtc学习———记录三：mediaStreamTrack

    参考: https://developer.mozilla.org/en-US/docs/Web/API/MediaStreamTrack 转自http://c.tieba.baidu.com/p/3 ...

  5. Table显示滚动条

    Table显示滚动条,要先把table放到一个div中,div的长度和宽度要固定,控制overflow属性为scroll <div style="width:700px; height ...

  6. Shell: how to list all db links in oracle DB to generate a flat file (生成dblink列表文件)

    如果数据库里有上百个DATABASE LINK, 而且同时要管理几十套这样的数据库,在日后改数据库用户密码时就要格外注意是否有DB LINK在使用,否则只改了LOCAL DB 的用户密码,没有级连修改 ...

  7. Java学习----集合函数

    1.List----有序的collection(序列) 与数组的不同:数据类型可以相同可以不同,数组的长度是预先定义好的,集合的长度也是预先定义好的,但是长度会随着元素的增加而增加 ArrayList ...

  8. WPF AutoGeneratingColumn 绑定下拉框

    WPF自动产生列,前台代码: <DataGrid x:Name="Dg" AutoGenerateColumns="True" CanUserAddRow ...

  9. C语言中float,double类型,在内存中的结构(存储方式)

    C语言中float,double类型,在内存中的结构(存储方式)从存储结构和算法上来讲,double和float是一样的,不一样的地方仅仅是float是32位的,double是64位的,所以doubl ...

  10. 练习2 F题 - 平方和与立方和

      Time Limit:1000MS     Memory Limit:32768KB     64bit IO Format:%I64d & %I64u   Description 给定一 ...