Packagist/ezsystems/ezpublish-legacy: medium
Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads
Action: Upgrade ezsystems/ezpublish-legacy to 5.3.12.6 or later.
composer require ezsystems/ezpublish-legacy:2018.9.1.3composer require ezsystems/ezpublish-legacy:2018.6.1.4composer require ezsystems/ezpublish-legacy:2017.12.4.3composer require ezsystems/ezpublish-legacy:5.4.12.3composer require ezsystems/ezpublish-legacy:5.3.12.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 2018.9.0 | 2018.9.1.3 | - |
| 2018.6.0 | 2018.6.1.4 | - |
| 2011.0.0 | 2017.12.4.3 | - |
| 5.4.0 | 5.4.12.3 | - |
| 5.3.0 | 5.3.12.6 | - |
Fixed versions
| 2018.9.1.3 | 2018.6.1.4 | 2017.12.4.3 | 5.4.12.3 | 5.3.12.6 |
Sources
- osv: GHSA-pqjm-xcp8-wgmm
- https://github.com/ezsystems/ezplatform/commit/9a0c52dc4535e4b3ce379f80222dc53f705a2cfd
- https://github.com/ezsystems/ezpublish-legacy/commit/d21957bf202b091ab39dfb5be300f6c30be3933e
- https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-21-1.yaml
- https://github.com/ezsystems/ezpublish-legacy
- https://web.archive.org/web/20210614192208/https://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads
- http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads
published · modified · JSON