[SECURITY] [DLA 3147-1] twig security update

2022-10-1118:00:56

lists.debian.org

twig security update

php templating library

arbitrary file read

cve-2022-39261

debian 10 buster

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.7

Confidence

High

EPSS

0.003

Percentile

71.1%

JSON

Debian LTS Advisory DLA-3147-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
October 11, 2022 https://wiki.debian.org/LTS

Package : twig
Version : 2.6.2-2+deb10u1
CVE ID : CVE-2022-39261
Debian Bug : #1020991

It was discovered that there was a potential arbitrary file read
vulnerability in twig, a PHP templating library. It was caused by
insufficient validation of template names in 'source' and 'include'
statements.

For Debian 10 buster, this problem has been fixed in version
2.6.2-2+deb10u1.

We recommend that you upgrade your twig packages.

For the detailed security status of twig please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twig

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10allphp-twig< 2.6.2-2+deb10u1php-twig_2.6.2-2+deb10u1_all.deb
Debian11allphp-twig-html-extra< 2.14.3-1+deb11u2php-twig-html-extra_2.14.3-1+deb11u2_all.deb
Debian11allphp-twig-intl-extra< 2.14.3-1+deb11u2php-twig-intl-extra_2.14.3-1+deb11u2_all.deb
Debian10alltwig< 2.6.2-2+deb10u1twig_2.6.2-2+deb10u1_all.deb
Debian11allphp-twig-cssinliner-extra< 2.14.3-1+deb11u2php-twig-cssinliner-extra_2.14.3-1+deb11u2_all.deb
Debian11allphp-twig-extra-bundle< 2.14.3-1+deb11u2php-twig-extra-bundle_2.14.3-1+deb11u2_all.deb
Debian10allphp-twig-doc< 2.6.2-2+deb10u1php-twig-doc_2.6.2-2+deb10u1_all.deb
Debian11allphp-twig< 2.14.3-1+deb11u2php-twig_2.14.3-1+deb11u2_all.deb
Debian11allphp-twig-markdown-extra< 2.14.3-1+deb11u2php-twig-markdown-extra_2.14.3-1+deb11u2_all.deb
Debian11allphp-twig-inky-extra< 2.14.3-1+deb11u2php-twig-inky-extra_2.14.3-1+deb11u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	php-twig	< 2.6.2-2+deb10u1	php-twig_2.6.2-2+deb10u1_all.deb
Debian	11	all	php-twig-html-extra	< 2.14.3-1+deb11u2	php-twig-html-extra_2.14.3-1+deb11u2_all.deb
Debian	11	all	php-twig-intl-extra	< 2.14.3-1+deb11u2	php-twig-intl-extra_2.14.3-1+deb11u2_all.deb
Debian	10	all	twig	< 2.6.2-2+deb10u1	twig_2.6.2-2+deb10u1_all.deb
Debian	11	all	php-twig-cssinliner-extra	< 2.14.3-1+deb11u2	php-twig-cssinliner-extra_2.14.3-1+deb11u2_all.deb
Debian	11	all	php-twig-extra-bundle	< 2.14.3-1+deb11u2	php-twig-extra-bundle_2.14.3-1+deb11u2_all.deb
Debian	10	all	php-twig-doc	< 2.6.2-2+deb10u1	php-twig-doc_2.6.2-2+deb10u1_all.deb
Debian	11	all	php-twig	< 2.14.3-1+deb11u2	php-twig_2.14.3-1+deb11u2_all.deb
Debian	11	all	php-twig-markdown-extra	< 2.14.3-1+deb11u2	php-twig-markdown-extra_2.14.3-1+deb11u2_all.deb
Debian	11	all	php-twig-inky-extra	< 2.14.3-1+deb11u2	php-twig-inky-extra_2.14.3-1+deb11u2_all.deb