@ramsey ok, thanks, because I could only find people talking about the upcoming talk but nothing on actual mitigations (except update glibc), but nothing PHP specific.
@j3j5 Oh, okay. So, it’s specifically in glibc and not in PHP. I don’t know of any mitigations to apply to PHP source code for this, but users should upgrade glibc immediately (which will require rebuilding the PHP binaries).
@ramsey ok, so I guess that updating glibc only isn't enough for now, I'd need to either compile from source or wait for a recompiled version from my distro or repo, am I understanding correctly?
@j3j5 I’m sorry. I don’t know enough about how the distro packages work, so I can’t offer an authoritative response on this. I’d ask @ondrej, since he’s the one who would know best (at least for Debian). 🙂
@ramsey@j3j5 The security fixes get uploaded to the security server by the package maintainer and the security team processes the updates. Usually, the processing is quite fast for high severity bugs, but maybe the was not enough people over the weekend? I would give it a day - but I don’t have any insider information really…
@ramsey@j3j5 Unless I am missing something, that’s why we ditched static linking and only have dynamic linking, so only service (not system) restart after an upgrade is required.
Well, until some languages like Go thought it’s a good idea to embed a security vulnerability into zillion downstream packages - complete rebuild would be needed for those languages, but not for glibc…
@ondrej@j3j5 Got it. I thought when the dynamic library was rebuilt, all dependencies needed to be rebuilt, but maybe that’s not the case since the ABI doesn’t change.
@ramsey also, sorry for assuming you were talking about this but I just finished reading about it and saw you asking about glibc, on my mind IT HAD to be related
@ramsey Curious how this breaks down on age - there was “lib-see” and then later there was “Jee-lib-see” - so Olds might tend towards that pronunciation (I don't know if I parsed "gee-lib-see” right. Gee, like "ghee”? or "gee" like "Gee whiz!”)
Add comment