|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2018-03-09 21:10 UTC] stas@php.net
-Status: Open
+Status: Not a bug
[2018-03-09 21:10 UTC] stas@php.net
[2018-03-09 22:48 UTC] pollita@php.net
[2018-03-10 14:52 UTC] cmb@php.net
-Type: Security
+Type: Bug
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Dec 19 05:00:01 2025 UTC |
Description: ------------ Hello,PHP Security Team, Because I am not familiar with the ssl protocol.I don't know if the leaked information is normal return information.At the same time,I also do not know whether it is a security bug or not a bug. Test script: --------------- first step: nc -lvv 8080 Listening on [0.0.0.0] (family 0, port 8080) second step: ./php-7.2.3/sapi/cli/php -r 'file_get_contents("https://127.0.0.1:8080"); ' Then,it will leak information.file_get_contents function could be placed other functions. Actual result: -------------- Listening on [0.0.0.0] (family 0, port 8080) Connection from [127.0.0.1] port 8080 [tcp/http-alt] accepted (family 2, sport 53810) er�o�����!X�|L� R%����r�fb�/�+�0�,�����'�#�� �(�$� g3@k89��2�1�-�)�%�</j�2�.�*�&�=5���EDA� 127.0.0.1 2