Merge pull request #715 from darkpills/master

Adding CVE-2024-28859 for SwiftMailer gadget chain in Symfony 1.x
FriendsOfPHP · Apr 17, 2024 · 0495186 · 0495186
2 parents 3c56f97 + df0cce5
commit 0495186
Show file tree

Hide file tree

Showing 4 changed files with 38 additions and 0 deletions.
diff --git a/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml b/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml
@@ -0,0 +1,11 @@
+title:     Deserialization Gadget chain in Swift Mailer
+link:      https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r
+cve:       CVE-2024-28859
+branches:
+    5.x:
+        time:     2024-02-27 16:08:02
+        versions: ['>=4.0.0', '<5.4.13']
+    6.x:
+        time:     2020-12-08 19:18:59
+        versions: ['>=6.0.0', '<6.2.5']
+reference: composer://friendsofsymfony1/swiftmailer
diff --git a/friendsofsymfony1/symfony1/CVE-2024-28859.yaml b/friendsofsymfony1/symfony1/CVE-2024-28859.yaml
@@ -0,0 +1,8 @@
+title:     Deserialization Gadget chain in Swift Mailer dependancy
+link:      https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r
+cve:       CVE-2024-28859
+branches:
+    1.x:
+        time:     2024-02-27 20:26:56
+        versions: ['>=1.3.0', '<1.15.18']
+reference: composer://friendsofsymfony1/symfony1
diff --git a/friendsofsymfony1/symfony1/CVE-2024-28861.yaml b/friendsofsymfony1/symfony1/CVE-2024-28861.yaml
@@ -0,0 +1,8 @@
+title:     Deserialization Gadget chain in Symfony sfNamespacedParameterHolder
+link:      https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-pv9j-c53q-h433
+cve:       CVE-2024-28861
+branches:
+    1.x:
+        time:     2024-03-19 13:59:00
+        versions: ['>=1.1.0', '<1.15.19']
+reference: composer://friendsofsymfony1/symfony1
diff --git a/swiftmailer/swiftmailer/CVE-2024-28859.yaml b/swiftmailer/swiftmailer/CVE-2024-28859.yaml
@@ -0,0 +1,11 @@
+title:     Deserialization Gadget chain in Swift Mailer
+link:      https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r
+cve:       CVE-2024-28859
+branches:
+    5.x:
+        time:     null
+        versions: ['>=4.0.0', '<6.0.0']
+    6.x:
+        time:     2020-12-08 19:18:59
+        versions: ['>=6.0.0', '<6.2.5']
+reference: composer://swiftmailer/swiftmailer