GHSA-4qpj-gxxg-jqg4
GHSA-4qpj-gxxg-jqg4 · Swiftmailer Sendmail transport arbitrary shell execution
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Prior to 5.2.1, the sendmail transport (`Swift_Transport_SendmailTransport`) was vulnerable to an arbitrary shell execution if the "From" header came from a non-trusted source and no "Return-Path" is configured. This has been fixed in 5.2.1. If you are using sendmail as a transport, you are encouraged to upgrade as soon as possible.
Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
swiftmailer/swiftmailer Packagist
- Versiones
- 4.1.3
- 4.1.4
- 4.1.5
- 4.1.6
- 4.1.7
- v4.1.8
- v4.2.0
- v4.2.1
- v4.2.2
- v4.3.0
- v4.3.1
- v5.0.0
- v5.0.1
- v5.0.2
- v5.0.3
- v5.1.0
- v5.2.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 4.0.0, < 5.2.1
Actualiza a 5.2.1
Fuentes originales
- https://github.com/swiftmailer/swiftmailer/commit/b4b78af55e5e87f5ff07c06c6be7963c44562f80
- https://github.com/swiftmailer/swiftmailer/commit/efc430606a5faed864b969adfbdc5363ce2115a2
- https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/2014-06-13.yaml
- https://github.com/swiftmailer/swiftmailer
- https://web.archive.org/web/20150219063146/http://blog.swiftmailer.org/post/88660759928/security-fix-swiftmailer-5-2-1-released
- http://blog.swiftmailer.org/post/88660759928/security-fix-swiftmailer-5-2-1-released
- https://osv.dev/vulnerability/GHSA-4qpj-gxxg-jqg4