5 ms·
A version that has been end-of-lifed and is superseded by three minor releases is a pretty strong indication. The amount of work involved in backporting patche
by qewrffewqwfqew 11y ago
A version that has been end-of-lifed and is superseded by three minor releases is a pretty strong indication. The amount of work involved in backporting patches is likely to be significantly more than migrating to a supported version which receives timely patches.
- noja 11y agoNo it's not a strong indication at all. Red Hat does the backporting work for you. You choose that platform if you want your software you spent man-decades writing to keep working for 10-13 years.
- dolfje 11y agoIt is a strong indication, because we are talking about non-packaged versions. PHP 5.3 is still maintained in Ubuntu, so those hosters aren't on the blame list. Only if PHP 5.3 / 5.2 / 5.1 is used without package manager.
- noja 11y agoIt might be a strong enough indication to investigate further, but it is not a strong enough indication to out a company. You need to actively test the vulnerability to be sure (or relabel your page with a heavy disclaimer).