netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6377-hfv9-hqf6
GHSA-v8wj-f5c7-pvxf
This commit is contained in:
advisory-database[bot]
2025-05-29 21:03:52 +00:00
parent 3779d10582
commit 7ccf9326c5
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/11/GHSA-6377-hfv9-hqf6/GHSA-6377-hfv9-hqf6.json
+6 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6377-hfv9-hqf6",
"modified": "2024-11-12T19:42:25Z",
"modified": "2025-05-29T21:02:01Z",
"published": "2024-11-06T19:52:31Z",
"aliases": [
"CVE-2024-51754"
],
"summary": "Twig has unguarded calls to `__toString()` when nesting an object into an array",
"details": "### Description\n\nIn a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).\n\n### Resolution\n\nThe sandbox mode now checks the `__toString()` method call on all objects.\n\nThe patch for this issue is available [here](https://github.com/twigphp/Twig/commit/cafc608ece310e62a35a76f17e25c04ab9ed05cc) for the 3.11.x branch, and [here](https://github.com/twigphp/Twig/commit/d4a302681bca9f7c6ce2835470d53609cdf3e23e) for the 3.x branch.\n\n### Credits\n\nWe would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.\n",
"details": "### Description\n\nIn a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance).\n\n### Resolution\n\nThe sandbox mode now checks the `__toString()` method call on all objects.\n\nThe patch for this issue is available [here](https://github.com/twigphp/Twig/commit/cafc608ece310e62a35a76f17e25c04ab9ed05cc) for the 3.11.x branch, and [here](https://github.com/twigphp/Twig/commit/d4a302681bca9f7c6ce2835470d53609cdf3e23e) for the 3.x branch.\n\n### Credits\n\nWe would like to thank Jamie Schouten for reporting the issue and Fabien Potencier for providing the fix.",
"severity": [
{
"type": "CVSS_V3",
@@ -79,6 +79,10 @@
"type": "PACKAGE",
"url": "https://github.com/twigphp/Twig"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00039.html"
},
{
"type": "WEB",
"url": "https://symfony.com/blog/unguarded-calls-to-__tostring-when-nesting-an-object-into-an-array"
advisories/github-reviewed/2025/05/GHSA-v8wj-f5c7-pvxf/GHSA-v8wj-f5c7-pvxf.json
+6 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8wj-f5c7-pvxf",
"modified": "2025-05-27T17:59:52Z",
"modified": "2025-05-29T21:03:02Z",
"published": "2025-05-27T17:59:52Z",
"aliases": [
"CVE-2024-52588"
@@ -40,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52588"
},
{
"type": "PACKAGE",
"url": "https://github.com/strapi/strapi"
@@ -52,6 +56,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-05-27T17:59:52Z",
"nvd_published_at": null
"nvd_published_at": "2025-05-29T09:15:25Z"
}
}