Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 790203 (CVE-2020-36326) - [TRACKER] PHPMailer: Object injection through Phar Deserialization via addAttachment with a UNC pathname (CVE-2020-36326)
Summary: [TRACKER] PHPMailer: Object injection through Phar Deserialization via addAtt...
Status: RESOLVED FIXED
Alias: CVE-2020-36326
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords: Tracker
Depends on: 790206 790209
Blocks:
  Show dependency tree
 
Reported: 2021-05-14 13:58 UTC by GLSAMaker/CVETool Bot
Modified: 2021-05-14 14:06 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2021-05-14 13:58:57 UTC 
CVE-2020-36326 (https://nvd.nist.gov/vuln/detail/CVE-2020-36326):
  PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar
  Deserialization via addAttachment with a UNC pathname. NOTE: this is similar
  to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in
  which UNC pathnames were always considered unreadable by PHPMailer, even in
  safe contexts. As an unintended side effect, this fix eliminated the code
  that blocked addAttachment exploitation.