php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #67680 news.php.net can't be access via HTTPS
Submitted: 2014-07-24 17:36 UTC Modified: 2015-01-05 23:55 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: yannick@php.net Assigned:
Status: Verified Package: Systems problem
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2014-07-24 17:36 UTC] yannick@php.net
Description:
------------
https://news.php.net don't point to http://news.php.net

Expected result:
----------------
https://news.php.net will be acceded via HTTPS 


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-01-03 12:51 UTC] jacob@php.net
-Status: Open +Status: Verified
 [2015-01-03 12:51 UTC] jacob@php.net
Would be great to get all the PHP.net family of sites accessible *only* over TLS however I am not sure of the infrastructure constraints here.
 [2015-01-05 23:55 UTC] aharvey@php.net
-Package: Website problem +Package: Systems problem
 [2017-08-08 11:30 UTC] php dot net at thermoman dot de
Description
===========

news.php.net is running on port 80/http and delivering content that is submitted unencrypted over the public internet.

Impact
======

Having php.announce items containing PGP signatures and hashes transmitted via unencrypted channels a simple MITM attack is possible to alter contents on a news.php.net page and trick a visitor into downloading php source code releases from a thirdparty webserver and even supply the "correct" signature and hashes to the malicious source code archive.

Example
=======

Just visit http://news.php.net/php.announce/223 which will display URLs to download the source code from, hashes and PGP signatures.

Try to https://access news.php.net/ which results in "connection refused".
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Sun Nov 19 01:31:42 2017 UTC