Why it is very important to upgrade to PEAR 1.4.6 from PEAR 1.3.x

Friday, January 6. 2006

Why it is very important to upgrade to PEAR 1.4.6 from PEAR 1.3.x

PEAR 1.4.6 was just released at pear.php.net (http://pear.php.net/PEAR). This is a minor bugfix release and complete details are available at pear.php.net, but I must stress two points with extreme seriousness:

PEAR 1.4.6 fixes make install-pear INSTALL_ROOT=/rpm/packaging and introduces the --packagingroot option to install, which works like --installroot worked in PEAR 1.3.x
PEAR 1.3.x has several serious bugs and at least 2 serious security vulnerabilities. Using PEAR 1.3.x on a production machine is EXTREMELY dangerous

The second point applies to all people who think that the latest vulnerability in PEAR can be fixed in 1.3.5 with a simple patch. There are several unpublished serious bugs. A few days back, I was contacted by a diligent developer of a linux distribution who was wondering how serious the vulnerability in PEAR 1.4.2 and earlier is, and whether it would be possible to get a patch for PEAR 1.3.5. After reflection on the serious bugs in PEAR 1.3.x that were fixed in PEAR 1.4.x with unit testing, I came to realize that there is yet another serious security vulnerability in PEAR 1.3.x. I will publish the details shortly.pear.php

Don't hesitate, upgrade to PEAR 1.4.6 at your earliest convenience.

Posted by Greg Beaver in PEAR at 08:39 | Comments (5) | Trackbacks (0)

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

did you test version 1.4.6 with chiara_pear_server? i get this error:
Validation Error: task in file Server/mysqlinstall.php is invalid because of "Post-install script "Server/mysqlinstall.php" must declare exactly 1 class"

regards,
robert

#1 robert on 2006-01-09 13:15 (Reply)

this is due to the tokenizer extension being disabled on your machine, and a bug in PEAR that has been fixed in 1.4.7. Enable the tokenizer extension and this error goes away.

#1.1 Greg Beaver (Homepage) on 2006-02-14 21:51 (Reply)

thanx, that works now.
but - i can't upload packages:
Uncaught exception 'Chiara_PEAR_Server_ExceptionInvalidRelease' with message 'Invalid release uploaded: "Unknown channel "pear.chef""' in /usr/lib/php5/share/pear/Chiara/PEAR/Server/Release.php:27

pear.chef is the name of the channel (internal server) it's displayed in frontend.php and i placed that name in the tag of the package.

pear list-all --channel pear.chef

works ok.

#1.1.1 robert on 2006-02-20 14:39 (Reply)

hi Robert,

The best option is to add a PEAR_Config::singleton() call to your admin frontend page. Although you could do this manually, it is easiest to simply re-run the post-install script, and double check the location of the PEAR config file - this should be the same location you see when you run:

pear config-show

if it isn't, then enter the full path, and this will fix your problem

#1.1.1.1 Greg Beaver (Homepage) on 2006-02-20 22:11 (Reply)

thank you. finally it works. i think that dealt with /etc/pear.conf vs. /root/.pearrc and some issues with my pear install.

since i'm on a gentoo machine, here's my tipp for a clean install:
delete every pear directory, every pear.conf, .pearrc
emerge PEAR-PEAR
so include_paths and configs are gentoo-like, don't use go pear...
install pear packages with pear install, don't use emerge ...

#1.1.1.1.1 robert on 2006-02-22 09:57 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Standard emoticons like :-) and ;-) are converted to images. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: BBCode format allowed You can use [geshi lang=lang_name [,ln={y\|n}]][/lang] tags to embed source code snippets
	Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.