[Security Advisory] Phar object injection in PHPMailer - CVE-2018-19296

OXID Announcements
1

Originally published at: [Security Advisory] Phar object injection in PHPMailer - CVE-2018-19296

PHPMailer version used in OXID eShop seems to be vulnerable. Fortunately, we do not use this vulnerable method in core. Please check your extensions/modules for using the vulnerable method and fix with the proposed workaround!

2

Unfortunately, the non-official workaround didn’t work for me, but I have an alternative that works independently of Linux:

For our installations, i still use the metapackages from OXID (“oxid-esales / oxideshop-metapackage-ce”: “v6.3.0”).

The phpMailer version is firmly defined there (“phpmailer / phpmailer”: “v6.4.0”).

Until the next OXID release I have added the following entry in our central composer.json in the require area: “phpmailer / phpmailer”: “v6.4.1 as v6.4.0”,

This will install version v6.4.1.

1 Like
3

shouldn’t it be like that?

“phpmailer / phpmailer”: “v6.4.1 as v6.4.0”,

1 Like
4

Ahm, you are right. I’ve corrected it. :slight_smile:

2 Likes