Adding CVE-2024-28859 for SwiftMailer gadget chain in Symfony 1.x

[darkpills]

There is a deserialization gadget chain in SwiftMailer that impacts Symfony 1.x.
Adding this in both SwiftMailer and Symfony directories

[xabbuh]

Suggested change

	reference: composer://swiftmailer/swiftmailer
	reference: composer://friendsofsymfony1/swiftmailer

(and the filename needs to be changed accordingly)

[darkpills]

Hello, @xabbuh , thank for you checks. reference for the file swiftmailer/swiftmailer/CVE-2024-28859.yaml corresponds to swiftmailer/swiftmailer repository. But it is archived and there has been a fork. So I suggest maybe making 2 files for referencing both repositories?

[stof]

As they published a fork with a fix, I suggest adding a separate advisory for friendsofsymfony1/swiftmailer (where 5.4.13 provides a patch for 5.x thanks to FriendsOfSymfony1/swiftmailer#18)

[darkpills]

php validator.php fails asking for upper bounds to the version number but there is no upper bound since the issue is not resolved and won't be on swiftmailer/swiftmailer repository at least. How do you solve this situation?

[thirsch]

php validator.php fails asking for upper bounds to the version number but there is no upper bound since the issue is not resolved and won't be on swiftmailer/swiftmailer repository at least. How do you solve this situation?

Hi @darkpills, maybe just adding the latest release as the upper bound? As it is unlikely that there will come a new release in the archived repository. But I'm not sure, if it's the way to go here.

[darkpills]

@thirsch I added upper bounds and aligned file path with composer path. I also added another CVE. I think it should be ok now.

[thePanz]

Thank you @darkpills for taking care of this 👍

[stof]

an unpatched vulnerability is supported. But you should have null as the time as there would be not timestamp for the release of the patch.

[stof]

As they published a fork with a fix, I suggest adding a separate advisory for friendsofsymfony1/swiftmailer (where 5.4.13 provides a patch for 5.x thanks to FriendsOfSymfony1/swiftmailer#18)

[naderman]

@stof is this fine now?