{"id":50289326,"user":"cowlevel","time":1793282938,"time_ago":"8 hours ago","type":"comment","content":"

Can you? Initial suggestions to block multipart content-types were a red herring.","comments":[{"id":50290137,"user":"1718627440","time":1793285718,"time_ago":"7 hours ago","type":"comment","content":"

In theory yes. In practice, I don't know, I hope my provider patched it properly.","comments":[{"id":50290583,"user":"cowlevel","time":1793287554,"time_ago":"6 hours ago","type":"comment","content":"

What specific configuration would you recommend to block the vulnerability without actually patching it?","comments":[{"id":50290625,"user":"1718627440","time":1793287690,"time_ago":"6 hours ago","type":"comment","content":"

None. Like I wrote "I don't know, I hope my provider patched it properly."","comments":[{"id":50290974,"user":"cowlevel","time":1793288922,"time_ago":"6 hours ago","type":"comment","content":"

Then why did you say

> you can prevent PHP being executed on malicious data by configuring the webserver.","comments":[{"id":50291491,"user":"1718627440","time":1793290723,"time_ago":"6 hours ago","type":"comment","content":"

You can do this. I don't know how, and I don't think it's a feasible use of my time, to find out how. It's obviously computable on a Turing machine, because they were able to patch PHP.","comments":[{"id":50292211,"user":"cowlevel","time":1793292964,"time_ago":"5 hours ago","type":"comment","content":"

So it was useless advice? You presented it as if anyone not following the advice is incompetent, now you suggest nobody knows how to do it. Is everyone incompetent?","comments":[{"id":50292643,"user":"1718627440","time":1793294387,"time_ago":"5 hours ago","type":"comment","content":"

What? I never claimed it was "advice"? I explained how other people could have arrived at the conclusion that there can be worse things than a single language interpreter being vulnerable to a unconditional RCE. Were you answering to the wrong comment?","comments":[],"comments_count":0,"level":6,"url":"item?id=50292643"}],"comments_count":1,"level":5,"url":"item?id=50292211"},{"id":50292761,"user":"kxrm","time":1793294779,"time_ago":"4 hours ago","type":"comment","content":"

> I don't know how

You are spreading misinformation then.

The configuration change was never a full protection from this vulnerability because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.","comments":[{"id":50292924,"user":"1718627440","time":1793295334,"time_ago":"4 hours ago","type":"comment","content":"

> You are spreading misinformation then.

> because the problem is with how PHP processed the request well before the configuration or your PHP code was executed.

That's what I wrote? You can't do anything once PHP executed. It could still be worse, because you can still prevent PHP from running, because there is still the webserver before. If it were in the webserver itself, you couldn't do anything, short of stopping the server from running.

> The configuration change was never a full protection from this vulnerability

It is, if the configuration change prevents PHP from running. That's how you could say it is overblown. You are not vulnerable if you don't run PHP.","comments":[],"comments_count":0,"level":6,"url":"item?id=50292924"}],"comments_count":1,"level":5,"url":"item?id=50292761"}],"comments_count":4,"level":4,"url":"item?id=50291491"},{"id":50291189,"user":"jstanley","time":1793289667,"time_ago":"6 hours ago","type":"comment","content":"

Configure your webserver to not execute PHP code.","comments":[],"comments_count":0,"level":4,"url":"item?id=50291189"}],"comments_count":6,"level":3,"url":"item?id=50290974"}],"comments_count":7,"level":2,"url":"item?id=50290625"}],"comments_count":8,"level":1,"url":"item?id=50290583"}],"comments_count":9,"level":0,"url":"item?id=50290137"}],"comments_count":10,"url":"item?id=50289326"}

Comment by cowlevel