Bug 636615 - ser: multiple vulnerabilities in embedded Smarty (2.6.2)
ser: multiple vulnerabilities in embedded Smarty (2.6.2)
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
public=20101013,reported=20100922,sou...
: Security
Depends On: 642808
Blocks:
  Show dependency treegraph
 
Reported: 2010-09-22 13:30 EDT by Vincent Danen
Modified: 2015-07-31 08:22 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 636239
: 636620 (view as bug list)
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2010-09-22 13:30:33 EDT
Silvio Cesare reported that serweb (part of the ser package) includes an embedded copy of the Smarty PHP template engine that is vulnerable to a number of security-related issues.  The version of Smarty bundled in serweb 0.9.4 is 2.6.2, while the current version of Smarty is 2.6.25.  This would make the embedded version of Smarty, and thus serweb, vulnerable to a number of issues with CVE names, including:

CVE-2009-1669
CVE-2008-4811
CVE-2008-4810
CVE-2008-1066

There may be others as well.  The Smarty changelog [1] does identify a number of fixes since the 2.6.2 release.

It does not look as though there has been any upstream activity in two years.  Four years ago Smarty was updated to 2.6.10 in CVS [2], but that was not reflected in any actual release.

Ideally, we should update the embedded version of Smarty to 2.6.25, however I have no idea if that will break anything as that is quite the jump.  We may have to identify and backport all the security fixes.

[1] http://www.smarty.net/changelog.php
[2] http://cvs.berlios.de/cgi-bin/viewvc.cgi/serweb/serweb/smarty/
Comment 1 Vincent Danen 2010-09-22 13:50:09 EDT
Sent an email to serweb-users@iptel.org informing them of the issue.  Will wait a bit for a response before making public.
Comment 2 Vincent Danen 2010-10-13 16:46:06 EDT
There has been no response from upstream at all, so making this public now.

What would be ideal here is to update the embedded version of smarty in ser to the latest upstream version, but I don't know how practical that is (i.e. what may have changed, etc.).

It looks like this version of ser has existed since Feb 2006 in Fedora, and smarty 2.6.2 is pretty old as well.  There have been some CVS-based updates noted on the site: http://ftp.iptel.org/pub/ser/daily-snapshots/stable/ but even the latest one there is over a year old.

Not sure what to do here other than update the embedded copy of smarty to the latest version and make sure it still works as expected.
Comment 3 Vincent Danen 2010-10-13 16:48:55 EDT
Created ser tracking bugs for this issue

Affects: fedora-all [bug 642808]

Note You need to log in before you can comment on or make changes to this bug.