CVE-2022-29221
24.05.2022, 15:15
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.| Vendor | Product | Version |
|---|---|---|
| smarty | smarty | 𝑥 < 3.1.45 |
| smarty | smarty | 4.0.0 ≤ 𝑥 < 4.1.1 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| collabtive |
| ||||||||||||||||||
| galette |
| ||||||||||||||||||
| gosa |
| ||||||||||||||||||
| postfixadmin |
| ||||||||||||||||||
| smarty3 |
| ||||||||||||||||||
| smarty4 |
|
References