Bug 902365 (CVE-2012-6113)

Summary:	CVE-2012-6113 php (openssl extension): Process memory sensitive information disclosure due to missing variable initialization
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jorton, rcollet, rpm, webstack-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-01-30 05:58:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	902366

Description Jan Lieskovsky 2013-01-21 13:50:16 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6113 to the following vulnerability:

The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

References:
[1] http://openwall.com/lists/oss-security/2013/01/18/6
[2] http://git.php.net/?p=php-src.git;a=commit;h=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e
[3] https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793
[4] https://bugs.php.net/bug.php?id=61413

Comment 2 Remi Collet 2013-01-21 14:20:32 UTC

I think this doesn't affects php (RHEL-6) nor php53 (RHEL-5) which are 5.3.3 based.

According to CVE, issue was introduced, int php-5.3.9, by
http://git.php.net/?p=php-src.git;a=commitdiff;h=095cbc48a8f0090f3b0abc6155f2b61943c9eafb

After check, this is not applied in any of our patches.

Comment 4 Huzaifa S. Sidhpurwala 2013-01-30 05:58:21 UTC

Statement:

Not Vulnerable. This issue does not affect the version of php as shipped with Red Hat Enterprise Linux 5 and 6. This issue does not affect the version of php53 as shipped with Red Hat Enterprise Linux 5.

Comment 5 Huzaifa S. Sidhpurwala 2013-01-30 05:58:57 UTC

This issue did NOT affect the versions of the php package, as shipped with Fedora release of 16, 17, and 18.