Bug 790206

Summary:	dev-php/PHPMailer: Object injection through Phar Deserialization via addAttachment with a UNC pathname (CVE-2020-36326)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	mjo, php-bugs
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~2 [noglsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	790203

Description GLSAMaker/CVETool Bot gentoo-dev

2021-05-14 13:59:56 UTC

CVE-2020-36326 (https://nvd.nist.gov/vuln/detail/CVE-2020-36326):
  PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar
  Deserialization via addAttachment with a UNC pathname. NOTE: this is similar
  to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in
  which UNC pathnames were always considered unreadable by PHPMailer, even in
  safe contexts. As an unintended side effect, this fix eliminated the code
  that blocked addAttachment exploitation.

Comment 1 Larry the Git Cow gentoo-dev

2021-05-14 14:05:47 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=0bf7552549b512c36af585916ce1c946abad4ecf

commit 0bf7552549b512c36af585916ce1c946abad4ecf
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2021-05-14 14:05:35 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2021-05-14 14:05:43 +0000

    dev-php/PHPMailer: security cleanup
    
    Bug: https://bugs.gentoo.org/790206
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 dev-php/PHPMailer/Manifest               |  4 --
 dev-php/PHPMailer/PHPMailer-6.1.6.ebuild | 73 -------------------------------
 dev-php/PHPMailer/PHPMailer-6.1.7.ebuild | 73 -------------------------------
 dev-php/PHPMailer/PHPMailer-6.2.0.ebuild | 74 --------------------------------
 dev-php/PHPMailer/PHPMailer-6.4.0.ebuild | 74 --------------------------------
 5 files changed, 298 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6c4f553e9cb1ccb7b549b7fb9dbf329326926699

commit 6c4f553e9cb1ccb7b549b7fb9dbf329326926699
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2021-05-14 14:04:47 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2021-05-14 14:05:43 +0000

    dev-php/PHPMailer: bump to v6.4.1
    
    Bug: https://bugs.gentoo.org/790206
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 dev-php/PHPMailer/Manifest               |  1 +
 dev-php/PHPMailer/PHPMailer-6.4.1.ebuild | 74 ++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+)

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2021-05-14 14:06:23 UTC

Repository is clean, all done!