PHP Code Injection by malicious block or filename in Smarty
概要
PHP Code Injection by malicious block or filename in Smarty
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-29221 smarty3 修正版: 3.1.39-2+deb11u1
- Ubuntu UBUNTU-CVE-2022-29221 collabtive
参照URL
- advisory github.com
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- patch github.com
- web github.com
- web github.com
- web lists.debian.org