Summary
Fabien Potencier discovered that Twig did not run sandbox security checks
in some circumstances. An attacker could possibly use this issue to cause
a denial of service or execute arbitrary commands. This issue only affected
Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-45411)
Jamie Schouten discovered that Twig could bypass the security policy for
an object call. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2024-51754)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | php-twig | 2.12.5-1ubuntu0.1~esm2 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | php-twig | 3.3.8-2ubuntu4+esm2 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | php-twig | 3.8.0-2ubuntu0.1~esm1 |
Vulnerabilities 2
-
High 8.6
Twig has a possible sandbox bypass
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
-
Low 2.2
Unguarded calls to __toString() when nesting an object into an array in Twig
Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a f…