PT-2024-40077 · Unknown · Swiftmailer

Published 2024-05-29 · Updated 2024-05-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: SwiftMailer versions prior to 5.2.1

Description: The issue allows for arbitrary shell execution if the From header comes from a non-trusted source and no Return-Path is configured. This can be exploited when using the sendmail transport, specifically the Swift Transport SendmailTransport.

Recommendations: For versions prior to 5.2.1, upgrade to version 5.2.1 or later as soon as possible to fix the issue. As a temporary workaround, consider configuring a Return-Path to minimize the risk of exploitation when using the sendmail transport.

Related Identifiers

GHSA-4QPJ-GXXG-JQG4

Affected Products

Swiftmailer

References · 7

• https://osv.dev/vulnerability/GHSA-4qpj-gxxg-jqg4 · Vendor Advisory
• https://github.com/swiftmailer/swiftmailer · Note
• https://github.com/swiftmailer/swiftmailer/commit/efc430606a5faed864b969adfbdc5363ce2115a2 · Note
• https://github.com/swiftmailer/swiftmailer/commit/b4b78af55e5e87f5ff07c06c6be7963c44562f80 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/2014-06-13.yaml · Note
• http://blog.swiftmailer.org/post/88660759928/security-fix-swiftmailer-5-2-1-released · Note
• https://web.archive.org/web/20150219063146/http://blog.swiftmailer.org/post/88660759928/security-fix-swiftmailer-5-2-1-released · Note