3

As many of you know there are multiple vulnerabilities that pertain to PHP 7.1, 7.2, and 7.3. I currently run PHP 5.6 with Magento 1.7. I am pretty confident that 1.7 does NOT support any of the recent PHP 7.X versions.

What should be our next steps, is there a high risk of keep running PHP 5.6?

Sources:

https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2019-087/

https://support.magento.com/hc/en-us/articles/360033561271

Improve this question

1 Answer 1

Reset to default
1

I asked this question too on the r/PHP subreddit, and got some useful info on it It seems as though there are OSes and repos providing backports of the security fix for the older EOL versions (like 5.6).

See here for the thread: https://www.reddit.com/r/PHP/comments/d2syvg/is_cve201913224_an_issue_for_php5x_70/

EDIT:

You can get Debian/Ubuntu security backports via the Ondrej PHP repo, and CentOS/RHEL can get backports via the REMI repos. If you need the PHP source code with backports, Microsoft provide a GitHub Repo for that.

Improve this answer
4
  • So what is the next course of action? Magento 1.9.x supports PHP 7.2. But its HIGHLY unlikely they will create a PHP 7.2+ compatibility patch for 1.7.
    – Icon
    Commented Sep 12, 2019 at 17:06
  • The only feasible solution is to upgrade to 1.9.3x and install Magento's PHP 7.2 patch, but that is tons of work. 2nd option... leave as-is.. although its not a good practice.
    – Icon
    Commented Sep 12, 2019 at 17:09
  • Yes there's the option of upgrading to PHp7.2 but like you said, it's a lot of work and not a good option for most. Check whether you're able to get security backports with your OS, I know Debian & Ubuntu have this via the ondrej/php repo: (launchpad.net/~ondrej/+archive/ubuntu/php/…) and I know CentOS/RHEL are also quite committed to backports
    – Rhys - SproutDesk
    Commented Sep 12, 2019 at 17:16
  • 1
    I've added some links in an edit on this answer with some more info on where to get backports
    – Rhys - SproutDesk
    Commented Sep 12, 2019 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.