Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS0yOWdwLTJjM20tM2o2bc0hTw

Sandbox Escape by math function in smarty

Impact

Template authors could run arbitrary PHP code by crafting a malicious math string.
If a math string is passed through as user provided data to the math function, external users could run arbitrary PHP code by crafting a malicious math string.

Patches

Please upgrade to 4.0.2 or 3.1.42 or higher.

References

See documentation on Math function.

For more information

If you have any questions or comments about this advisory please open an issue in the Smarty repo

Permalink: https://github.com/advisories/GHSA-29gp-2c3m-3j6m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yOWdwLTJjM20tM2o2bc0hTw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: 3 months ago


CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Identifiers: GHSA-29gp-2c3m-3j6m, CVE-2021-29454
References: Repository: https://github.com/smarty-php/smarty
Blast Radius: 27.3

Affected Packages

packagist:smarty/smarty
Dependent packages: 449
Dependent repositories: 2,359
Downloads: 24,951,053 total
Affected Version Ranges: >= 4.0.0, < 4.0.2, < 3.1.42
Fixed in: 4.0.2, 3.1.42
All affected versions: 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.33, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.19, 3.1.20, 3.1.21, 3.1.23, 3.1.24, 3.1.25, 3.1.26, 3.1.27, 3.1.28, 3.1.29, 3.1.30, 3.1.31, 3.1.32, 3.1.33, 3.1.34, 3.1.35, 3.1.36, 3.1.37, 3.1.38, 3.1.39, 3.1.40, 3.1.41, 4.0.0, 4.0.1
All unaffected versions: 3.1.42, 3.1.43, 3.1.44, 3.1.45, 3.1.46, 3.1.47, 3.1.48, 4.0.2, 4.0.3, 4.0.4, 4.1.0, 4.1.1, 4.2.0, 4.2.1, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.5.2, 5.0.0, 5.0.1, 5.0.2