DSA-5248: -1 php-twig -- security update
Published Oct 4, 2022
·Updated
Marlon Starkloff discovered that twig, a template engine for PHP, did not correctly enforce sandboxing. This would allow a malicious user to execute arbitrary code.
Affected Software
2 affected components
debian/php-twig
debian/php-twig
Event History
Oct 4, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
Who is exposed to this issue?
Deployments of the Debian php-twig package that use Twig sandboxing and allow malicious users to influence templates or sandboxed template behavior are exposed to arbitrary code execution.
2
What does an attacker need to exploit it?
The attacker needs to be able to act as a malicious user in a context where Twig sandboxing is relied upon. The issue is that the sandbox restrictions were not correctly enforced.
3
Are installations using Twig without sandboxing affected in the same way?
The available information specifically identifies incorrect enforcement of Twig sandboxing. It does not establish impact for deployments that do not use the sandbox feature.