Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 798138 (CVE-2021-3603) - <dev-php/PHPMailer-6.5.0: complex remote code execution (CVE-2021-3603)
Summary: <dev-php/PHPMailer-6.5.0: complex remote code execution (CVE-2021-3603)
Status: RESOLVED FIXED
Alias: CVE-2021-3603
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://www.huntr.dev/bounties/1-PHPM...
Whiteboard: ~2 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2021-06-24 03:58 UTC by John Helmert III
Modified: 2021-07-01 20:41 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III gentoo-dev Security 2021-06-24 03:58:27 UTC
CVE-2021-3603 (https://github.com/PHPMailer/PHPMailer/commit/45f3c18dc6a2de1cb1bf49b9b249a9ee36a5f7f3):

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). If the $patternselect parameter to validateAddress() is set to 'php' (the default, defined by PHPMailer::$validator), and the global namespace contains a function called php, it will be called in preference to the built-in validator of the same name. Mitigated in PHPMailer 6.5.0 by denying the use of simple strings as validator function names.

Not really happy with this severity, but it doesn't matter since it's all
unstable anyway. Please cleanup.
Comment 1 Larry the Git Cow gentoo-dev 2021-07-01 19:26:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3e7ae6985e5f2c3ac6ebcc30d94449337a09bf31

commit 3e7ae6985e5f2c3ac6ebcc30d94449337a09bf31
Author:     Michael Orlitzky <mjo@gentoo.org>
AuthorDate: 2021-07-01 19:25:09 +0000
Commit:     Michael Orlitzky <mjo@gentoo.org>
CommitDate: 2021-07-01 19:25:09 +0000

    dev-php/PHPMailer: remove vulnerable PHPMailer-6.4.1.ebuild.
    
    Bug: https://bugs.gentoo.org/798138
    Package-Manager: Portage-3.0.20, Repoman-3.0.2
    Signed-off-by: Michael Orlitzky <mjo@gentoo.org>

 dev-php/PHPMailer/Manifest               |  1 -
 dev-php/PHPMailer/PHPMailer-6.4.1.ebuild | 74 --------------------------------
 2 files changed, 75 deletions(-)
Comment 2 John Helmert III gentoo-dev Security 2021-07-01 20:41:11 UTC
Thanks! (Sorry for bad summary, terrible accident)