CVE-2021-3603 (https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3): PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names. Not really happy with this severity, but it doesn't matter since it's all unstable anyway. Please cleanup.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3e7ae6985e5f2c3ac6ebcc30d94449337a09bf31 commit 3e7ae6985e5f2c3ac6ebcc30d94449337a09bf31 Author: Michael Orlitzky <mjo@gentoo.org> AuthorDate: 2021-07-01 19:25:09 +0000 Commit: Michael Orlitzky <mjo@gentoo.org> CommitDate: 2021-07-01 19:25:09 +0000 dev-php/PHPMailer: remove vulnerable PHPMailer-6.4.1.ebuild. Bug: https://bugs.gentoo.org/798138 Package-Manager: Portage-3.0.20, Repoman-3.0.2 Signed-off-by: Michael Orlitzky <mjo@gentoo.org> dev-php/PHPMailer/Manifest | 1 - dev-php/PHPMailer/PHPMailer-6.4.1.ebuild | 74 -------------------------------- 2 files changed, 75 deletions(-)
Thanks! (Sorry for bad summary, terrible accident)
