[Bugs] [Bug 13315] New: [CVE 21] snappy 1.1.8 CVEs found

[bugzilla]

https://bugzilla.rosalinux.ru/show_bug.cgi?id=13315

          Platform: 2021.1
            Bug ID: 13315
           Summary: [CVE 21] snappy 1.1.8  CVEs found
    Classification: ROSA-based products
           Product: ROSA Fresh
           Version: All
          Hardware: All
               URL: CVE-2023-28115,
                OS: Linux
            Status: CONFIRMED
          Severity: normal
          Priority: Normal
         Component: System (kernel, glibc, systemd, bash, PAM...)
          Assignee: bugs на lists.rosalinux.ru
          Reporter: y.tumanov на rosalinux.ru
        QA Contact: bugs на lists.rosalinux.ru
                CC: s.matveev на rosalinux.ru, y.tumanov на rosalinux.ru
  Target Milestone: ---
             Flags: secteam_verified?

Please patch CVEs for package snappy version 1.1.8

INFO (CVEs are): snappy 1.1.8
 cves found
CVE-2023-28115
Desc: Snappy is a PHP library allowing thumbnail, snapshot or PDF generation
from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR
deserialization due to a lack of checking on the protocol before passing it
into the `file_exists()` function. If an attacker can upload files of any type
to the server he can pass in the phar:// protocol to unserialize the uploaded
file and instantiate arbitrary PHP objects. This can lead to remote code
execution especially when snappy is used with frameworks with documented POP
chains like Laravel/Symfony vulnerable developer code. If a user can control
the output file from the `generateFromHtml()` function, it will invoke
deserialization. This vulnerability is capable of remote code execution if
Snappy is used with frameworks or developer code with vulnerable POP chains. It
has been fixed in version 1.4.2.
Link: https://nvd.nist.gov/vuln/detail/CVE-2023-28115
Severity: CRITICAL

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
----------- следущая часть -----------
Вложение в формате HTML было извлечено…
URL: <http://lists.rosalinux.ru/pipermail/bugs/attachments/20230503/617dd55e/attachment.html>