GHSA-45xg-4w5x-j429
GHSA-45xg-4w5x-j429 · TYPO3 Arbitrary Shell Execution in Swiftmailer library
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The swiftmailer library in use allows to execute arbitrary shell commands if the "From" header comes from a non-trusted source and no "Return-Path" is configured. Affected are only TYPO3 installation the configuration option ``` $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport'] ``` is set to "sendmail". Installations with the default configuration are not affected.
CVSS 8.1 · Alta · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
typo3/cms Packagist
- Versiones
- 6.2.0
- 6.2.1
- 6.2.2
- 6.2.3
- 6.2.4
- 6.2.5
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 6.2.0, < 6.2.6
Actualiza a 6.2.6
typo3/cms Packagist
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 6.1.0, < 6.1.12
Actualiza a 6.1.12
typo3/cms Packagist
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 4.7.0, < 4.7.20
Actualiza a 4.7.20
typo3/cms Packagist
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 4.5.0, < 4.5.37
Actualiza a 4.5.37
Fuentes originales
- https://github.com/TYPO3/typo3/commit/313c4bba53dd78803a9ee97c1f6f1d450a521521
- https://github.com/TYPO3/typo3/commit/6af37574e063929eaab066dd9920b1fa8815da12
- https://github.com/TYPO3/typo3/commit/dbdd9f22b7cebf43f2e4abdb2a6a8a9f32af8f61
- https://github.com/TYPO3/typo3/commit/ead183c5acf25b7e1121adee5a5860bd9b5f05a2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2014-10-22-2.yaml
- https://github.com/TYPO3/typo3
- https://typo3.org/security/advisory/typo3-core-sa-2014-002
- https://osv.dev/vulnerability/GHSA-45xg-4w5x-j429