Version `4.3.5` of `smarty/smarty` library in Extension:Widgets library has CVE-2024-35226
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	Osnard
	Jul 15 2024, 8:17 AM

Project Tags

Referenced Files

	F56435481: T370022.patch
	Jul 15 2024, 8:45 AM

Subscribers

Description

Recent "trivy" can on a container maintained by me revealed an issue with Extension:Widgets

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐
│ smarty/smarty    │ CVE-2024-35226 │ HIGH     │        │ v4.3.5            │ 5.1.1, 4.5.3  │ Smarty is a template engine for PHP, facilitating the │
│                  │                │          │        │                   │               │ separation of pr...                                   │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-35226            │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────┘

This particular version of the library seems to be in all current branches (REL1_39, REL1_42, master)

I am currently testing fixed version 4.5.3 and will provide a patch in case it works. I created this task to properly reference something in the commit message.

Related Objects

Mentioned In: T368628: Write and send supplementary release announcement for extensions and skins with security patches (1.39.9/1.41.3/1.42.2)

Event Timeline

Osnard created this task.Jul 15 2024, 8:17 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 15 2024, 8:17 AM

Osnard updated the task description. (Show Details)Jul 15 2024, 8:18 AM

Osnard updated the task description. (Show Details)

Attached potential patch. Not on gerrit yet.

Using the next minor version of the library seems to work. I didn't experience any issues so far. My proposal is to completely drop older versions, as most of them are very old already anyways.

T370022.patch648 BDownload

+MediaWiki-extensions-Widgets so this ticket can be found

Bawolff added a subscriber: Kghbln.Jul 15 2024, 9:13 AM

This patch looks good but I would like someone familiar with this extension to review it as well.

Kghbln added a subscriber: Yaron_Koren.Jul 15 2024, 4:40 PM

Fine with me. I see no reason why 4.5.3+ should not work with this extension. A field test with a couple of widgets confirmed this. If @Yaron_Koren is OK with this change, Robert could add the patch to Gerrit.

Yes, sounds good.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Widgets/+/1054486

Kghbln awarded a token.Jul 16 2024, 9:27 AM

REL1_39: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Widgets/+/1054642
REL1_42: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Widgets/+/1054643

sbassett added projects: Vuln-VulnComponent, SecTeam-Processed.Jul 16 2024, 11:42 PM

sbassett mentioned this in T368628: Write and send supplementary release announcement for extensions and skins with security patches (1.39.9/1.41.3/1.42.2).

I assume we can make this task public now, since the fixes were handled publicly in gerrit and are now merged? This issue will be reannounced within the next supplemental security release, due out around September 30th, 2024.

Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".Jul 22 2024, 4:55 PM

Mstyles changed the edit policy from "Custom Policy" to "All Users".

Mstyles moved this task from In Progress to Our Part Is Done on the Security-Team board.

I think this can be closed.

Version `4.3.5` of `smarty/smarty` library in Extension:Widgets library has CVE-2024-35226Closed, ResolvedPublicSecurityActions

Description

Related Objects

Event Timeline

Version `4.3.5` of `smarty/smarty` library in Extension:Widgets library has CVE-2024-35226
Closed, ResolvedPublicSecurity
Actions