{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "## 2.4.10 (2016-05-09)\n\n- Fix HeaderValue throwing an exception on legal characters\n\n## 2.4.9 (2015-11-23)\n\n### SECURITY UPDATES\n\n- **ZF2015-09**: `Zend\\Captcha\\Word` generates a \"word\" for a CAPTCHA challenge\n  by selecting a sequence of random letters from a character set. Prior to this\n  vulnerability announcement, the selection was performed using PHP's internal\n  `array_rand()` function. This function does not generate sufficient entropy\n  due to its usage of `rand()` instead of more cryptographically secure methods\n  such as `openssl_pseudo_random_bytes()`. This could potentially lead to\n  information disclosure should an attacker be able to brute force the random\n  number generation. This release contains a patch that replaces the\n  `array_rand()` calls to use `Zend\\Math\\Rand::getInteger()`, which provides\n  better RNG.\n- **ZF2015-10**: `Zend\\Crypt\\PublicKey\\Rsa\\PublicKey` has a call to `openssl_public_encrypt()`\n  which used PHP's default `$padding` argument, which specifies\n  `OPENSSL_PKCS1_PADDING`, indicating usage of PKCS1v1.5 padding. This padding\n  has a known vulnerability, the\n  [Bleichenbacher's chosen-ciphertext attack](http://crypto.stackexchange.com/questions/12688/can-you-explain-bleichenbachers-cca-attack-on-pkcs1-v1-5),\n  which can be used to recover an RSA private key. This release contains a patch\n  that changes the padding argument to use `OPENSSL_PKCS1_OAEP_PADDING`.\n\n  Users upgrading to this version may have issues decrypting previously stored\n  values, due to the change in padding. If this occurs, you can pass the\n  constant `OPENSSL_PKCS1_PADDING` to a new `$padding` argument in\n  `Zend\\Crypt\\PublicKey\\Rsa::encrypt()` and `decrypt()` (though typically this\n  should only apply to the latter):\n\n  ```php\n  $decrypted = $rsa->decrypt($data, $key, $mode, OPENSSL_PKCS1_PADDING);\n  ```\n\n  where `$rsa` is an instance of `Zend\\Crypt\\PublicKey\\Rsa`.\n\n  (The `$key` and `$mode` argument defaults are `null` and\n  `Zend\\Crypt\\PublicKey\\Rsa::MODE_AUTO`, if you were not using them previously.)\n\n  We recommend re-encrypting any such values using the new defaults.", "type": "security", "status": "stable", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2016-06-12 05:26:30", "date_modified": null, "date_approved": null, "date_testing": "2016-06-12 22:55:27", "date_stable": "2016-06-28 05:34:10", "alias": "FEDORA-EPEL-2016-86f7c45855", "test_gating_status": null, "from_tag": null, "date_pushed": "2016-06-28 05:34:10", "meets_testing_requirements": false, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-86f7c45855", "title": "php-ZendFramework2-2.4.10-1.el7 php-zendframework-zendxml-1.0.2-2.el7", "version_hash": "9ecb3ebb4f61bb8b2727bef6edf87d884299608a", "release": {"name": "EPEL-7", "long_name": "Fedora EPEL 7", "version": "7", "id_prefix": "FEDORA-EPEL", "branch": "epel7", "dist_tag": "epel7", "stable_tag": "epel7", "testing_tag": "epel7-testing", "candidate_tag": "epel7-testing-candidate", "pending_signing_tag": "epel7-signing-pending", "pending_testing_tag": "epel7-testing-pending", "pending_stable_tag": "epel7-pending", "override_tag": "epel7-override", "mail_template": "fedora_epel_legacy_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "unspecified", "testing_repository": null, "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "siwinski", "email": "shawn@iwin.ski", "id": 130, "avatar": "https://seccdn.libravatar.org/avatar/d42670db55f2a02bd45bb03a22919c9013b73f6ae62d6c1a9a2eab3afefa3334?s=24&d=retro", "openid": "siwinski.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by siwinski. ", "timestamp": "2016-06-12 05:26:30", "update_id": 60324, "user_id": 91, "id": 445484, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2016-06-12 23:19:12", "update_id": 60324, "user_id": 91, "id": 445717, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes", "timestamp": "2016-06-27 00:00:24", "update_id": 60324, "user_id": 91, "id": 451365, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by siwinski. ", "timestamp": "2016-06-27 21:53:50", "update_id": 60324, "user_id": 91, "id": 451701, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2016-06-28 08:19:22", "update_id": 60324, "user_id": 91, "id": 451920, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "php-ZendFramework2-2.4.10-1.el7", "signed": true, "release_id": 8, "type": "rpm", "epoch": 0}, {"nvr": "php-zendframework-zendxml-1.0.2-2.el7", "signed": true, "release_id": 8, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1289317, "title": "CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1289318, "title": "CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [epel-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1343990, "title": "[epel7][security] php-ZendFramework2-2.4.10 is available", "security": false, "parent": false, "feedback": []}, {"bug_id": 1343995, "title": "[f23][f22][security] php-ZendFramework2-2.4.10 is available", "security": false, "parent": false, "feedback": []}], "updateid": "FEDORA-EPEL-2016-86f7c45855", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}