Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00aDljLXY1dmctNW02bc0hUA

Access to restricted PHP code by dynamic static class access in smarty

Impact

Template authors could run restricted static php methods.

Patches

Please upgrade to 3.1.40 or higher.

References

See the documentation on Smarty security features on the static_classes access filter.

For more information

If you have any questions or comments about this advisory please open an issue in the Smarty repo

Permalink: https://github.com/advisories/GHSA-4h9c-v5vg-5m6m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00aDljLXY1dmctNW02bc0hUA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 3 years ago
Updated: 11 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00174
EPSS Percentile: 0.54696

Identifiers: GHSA-4h9c-v5vg-5m6m, CVE-2021-21408
References:

• https://github.com/smarty-php/smarty/security/advisories/GHSA-4h9c-v5vg-5m6m
• https://nvd.nist.gov/vuln/detail/CVE-2021-21408
• https://github.com/smarty-php/smarty/commit/19ae410bf56007a5ef24441cdc6414619cfaf664
• https://github.com/smarty-php/smarty/releases/tag/v3.1.43
• https://github.com/smarty-php/smarty/releases/tag/v4.0.3
• https://lists.debian.org/debian-lts-announce/2022/05/msg00005.html
• https://www.debian.org/security/2022/dsa-5151
• https://security.gentoo.org/glsa/202209-09
• https://lists.fedoraproject.org/archives/list/[email protected]/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/
• https://lists.fedoraproject.org/archives/list/[email protected]/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/
• https://github.com/FriendsOfPHP/security-advisories/blob/master/smarty/smarty/CVE-2021-21408.yaml
• https://github.com/advisories/GHSA-4h9c-v5vg-5m6m

Repository: https://github.com/smarty-php/smarty
Blast Radius: 29.7

Affected Packages