Silvio Cesare reported that serweb (part of the ser package) includes an embedded copy of the Smarty PHP template engine that is vulnerable to a number of security-related issues. The version of Smarty bundled in serweb 0.9.4 is 2.6.2, while the current version of Smarty is 2.6.25. This would make the embedded version of Smarty, and thus serweb, vulnerable to a number of issues with CVE names, including: CVE-2009-1669 CVE-2008-4811 CVE-2008-4810 CVE-2008-1066 There may be others as well. The Smarty changelog [1] does identify a number of fixes since the 2.6.2 release. It does not look as though there has been any upstream activity in two years. Four years ago Smarty was updated to 2.6.10 in CVS [2], but that was not reflected in any actual release. Ideally, we should update the embedded version of Smarty to 2.6.25, however I have no idea if that will break anything as that is quite the jump. We may have to identify and backport all the security fixes. [1] http://www.smarty.net/changelog.php [2] http://cvs.berlios.de/cgi-bin/viewvc.cgi/serweb/serweb/smarty/
Sent an email to serweb-users informing them of the issue. Will wait a bit for a response before making public.
There has been no response from upstream at all, so making this public now. What would be ideal here is to update the embedded version of smarty in ser to the latest upstream version, but I don't know how practical that is (i.e. what may have changed, etc.). It looks like this version of ser has existed since Feb 2006 in Fedora, and smarty 2.6.2 is pretty old as well. There have been some CVS-based updates noted on the site: http://ftp.iptel.org/pub/ser/daily-snapshots/stable/ but even the latest one there is over a year old. Not sure what to do here other than update the embedded copy of smarty to the latest version and make sure it still works as expected.
Created ser tracking bugs for this issue Affects: fedora-all [bug 642808]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.