Описание
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| twig | fixed | 2.7.1-1 | experimental | package |
| twig | fixed | 2.6.2-2 | package | |
| twig | no-dsa | jessie | package |
Примечания
https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077
https://symfony.com/blog/twig-sandbox-information-disclosure
Связанные уязвимости
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.
Уязвимость компилирующего обработчика шаблонов Twig, связанная с ошибками функционирования изолированной программной среды, позволяющая нарушителю получить доступ к конфиденциальным данным