Red Hat Bugzilla – Bug 636615
ser: multiple vulnerabilities in embedded Smarty (2.6.2)
Last modified: 2015-07-31 08:22:41 EDT
Silvio Cesare reported that serweb (part of the ser package) includes an embedded copy of the Smarty PHP template engine that is vulnerable to a number of security-related issues. The version of Smarty bundled in serweb 0.9.4 is 2.6.2, while the current version of Smarty is 2.6.25. This would make the embedded version of Smarty, and thus serweb, vulnerable to a number of issues with CVE names, including:
There may be others as well. The Smarty changelog  does identify a number of fixes since the 2.6.2 release.
It does not look as though there has been any upstream activity in two years. Four years ago Smarty was updated to 2.6.10 in CVS , but that was not reflected in any actual release.
Ideally, we should update the embedded version of Smarty to 2.6.25, however I have no idea if that will break anything as that is quite the jump. We may have to identify and backport all the security fixes.
Sent an email to firstname.lastname@example.org informing them of the issue. Will wait a bit for a response before making public.
There has been no response from upstream at all, so making this public now.
What would be ideal here is to update the embedded version of smarty in ser to the latest upstream version, but I don't know how practical that is (i.e. what may have changed, etc.).
It looks like this version of ser has existed since Feb 2006 in Fedora, and smarty 2.6.2 is pretty old as well. There have been some CVS-based updates noted on the site: http://ftp.iptel.org/pub/ser/daily-snapshots/stable/ but even the latest one there is over a year old.
Not sure what to do here other than update the embedded copy of smarty to the latest version and make sure it still works as expected.
Created ser tracking bugs for this issue
Affects: fedora-all [bug 642808]