[pkg-php-pear] Bug#1086884: php-twig: CVE-2024-51754 CVE-2024-51755

[Salvatore Bonaccorso]

Source: php-twig
Version: 3.14.0-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for php-twig.

CVE-2024-51754[0]:
| Twig is a template language for PHP. In a sandbox, an attacker can
| call `__toString()` on an object even if the `__toString()` method
| is not allowed by the security policy when the object is part of an
| array or an argument list (arguments to a function or a filter for
| instance). This issue has been patched in versions 3.11.2 and
| 3.14.1. All users are advised to upgrade. There are no known
| workarounds for this issue.


CVE-2024-51755[1]:
| Twig is a template language for PHP. In a sandbox, and attacker can
| access attributes of Array-like objects as they were not checked by
| the security policy. They are now checked via the property policy
| and the `__isset()` method is now called after the security check.
| This is a BC break. This issue has been patched in versions 3.11.2
| and 3.14.1. All users are advised to upgrade. There are no known
| workarounds for this issue.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-51754
    https://www.cve.org/CVERecord?id=CVE-2024-51754
    https://github.com/twigphp/Twig/security/advisories/GHSA-6377-hfv9-hqf6
[1] https://security-tracker.debian.org/tracker/CVE-2024-51755
    https://www.cve.org/CVERecord?id=CVE-2024-51755
    https://github.com/twigphp/Twig/security/advisories/GHSA-jjxq-ff2g-95vh

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore