Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.5947.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5947-1)
Summary:	The remote host is missing an update for the 'php-twig, twig' package(s) announced via the USN-5947-1 advisory.
Description:	Summary: The remote host is missing an update for the 'php-twig, twig' package(s) announced via the USN-5947-1 advisory. Vulnerability Insight: Fabien Potencier discovered that Twig was not properly enforcing sandbox policies when dealing with objects automatically cast to strings by PHP. An attacker could possibly use this issue to expose sensitive information. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-9942) Marlon Starkloff discovered that Twig was not properly enforcing closure constraints in some of its array filtering functions. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2022-23614) Dariusz Tytko discovered that Twig was not properly verifying input data utilized when defining pathnames used to access files in a system. An attacker could possibly use this issue to access unauthorized resources and expose sensitive information. (CVE-2022-39261) Affected Software/OS: 'php-twig, twig' package(s) on Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-9942 Bugtraq: 20190331 [SECURITY] [DSA 4419-1] twig security update (Google Search) https://seclists.org/bugtraq/2019/Mar/60 Debian Security Information: DSA-4419 (Google Search) https://www.debian.org/security/2019/dsa-4419 https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077 https://symfony.com/blog/twig-sandbox-information-disclosure Common Vulnerability Exposure (CVE) ID: CVE-2022-23614 https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v Debian Security Information: DSA-5107 (Google Search) https://www.debian.org/security/2022/dsa-5107 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO/ https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9 https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5 Common Vulnerability Exposure (CVE) ID: CVE-2022-39261 https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 Debian Security Information: DSA-5248 (Google Search) https://www.debian.org/security/2022/dsa-5248 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/ https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.