Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 681862 (CVE-2019-9942) - <dev-php/twig-1.40.1: sandbox information disclosure
Summary: <dev-php/twig-1.40.1: sandbox information disclosure
Status: RESOLVED FIXED
Alias: CVE-2019-9942
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: ~4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-03-27 15:31 UTC by Agostino Sarubbo
Modified: 2019-05-09 01:45 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2019-03-27 15:31:31 UTC 
From ${URL} :

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call 
the __toString() method on an object even if not allowed by the security policy in place.

Reference:
https://symfony.com/blog/twig-sandbox-information-disclosure

Upstream commit:
https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077



@maintainer(s): since the package or the affected version has never been marked as stable, we don't need to stabilize it. After the bump, please remove the affected versions from the tree.
Comment 1 Larry the Git Cow gentoo-dev 2019-05-06 19:46:35 UTC 
The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1b71d712064b76fd4b04d184948528528479b242

commit 1b71d712064b76fd4b04d184948528528479b242
Author:     Dirkjan Ochtman <djc@gentoo.org>
AuthorDate: 2019-05-06 19:46:15 +0000
Commit:     Dirkjan Ochtman <djc@gentoo.org>
CommitDate: 2019-05-06 19:46:15 +0000

    dev-php/twig: version bump to 1.40.1 (fixes CVE-2019-9942)
    
    Closes: https://bugs.gentoo.org/681862
    Signed-off-by: Dirkjan Ochtman <djc@gentoo.org>
    Package-Manager: Portage-2.3.62, Repoman-2.3.11

 dev-php/twig/Manifest                           |  1 +
 dev-php/twig/files/1.40.1-autoloader-path.patch | 16 +++++
 dev-php/twig/twig-1.40.1.ebuild                 | 87 +++++++++++++++++++++++++
 3 files changed, 104 insertions(+)
Comment 2 Dirkjan Ochtman (RETIRED) gentoo-dev 2019-05-06 19:48:07 UTC 
Sorry that took a bit long -- it's been very busy.
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2019-05-07 19:50:15 UTC 
Please drop vulnerable.
Comment 4 Dirkjan Ochtman (RETIRED) gentoo-dev 2019-05-08 20:01:01 UTC 
Done.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2019-05-09 01:45:29 UTC 
(In reply to Dirkjan Ochtman from comment #4)
> Done.

Thanks!