Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6550.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6550-1)
Summary:	The remote host is missing an update for the 'postfixadmin' package(s) announced via the USN-6550-1 advisory.
Description:	Summary: The remote host is missing an update for the 'postfixadmin' package(s) announced via the USN-6550-1 advisory. Vulnerability Insight: It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221) It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129) It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS). (CVE-2023-28447) Affected Software/OS: 'postfixadmin' package(s) on Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2022-29221 https://github.com/smarty-php/smarty/security/advisories/GHSA-634x-pc3q-cf4c Debian Security Information: DSA-5151 (Google Search) https://www.debian.org/security/2022/dsa-5151 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L777JIBIWJV34HS7LXPIDWASG7TT4LNI/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRAJVDRGCIY5UZ2PQHKDTT7RMKG6WJQQ/ https://security.gentoo.org/glsa/202209-09 https://github.com/smarty-php/smarty/commit/64ad6442ca1da31cefdab5c9874262b702cccddd https://github.com/smarty-php/smarty/releases/tag/v3.1.45 https://github.com/smarty-php/smarty/releases/tag/v4.1.1 https://lists.debian.org/debian-lts-announce/2022/05/msg00044.html Common Vulnerability Exposure (CVE) ID: CVE-2022-31129 https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZMX5YHELQVCGKKQVFXIYOTBMN23YYSRO/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWY24RJA3SBJGA5N4CU4VBPHJPPPJL5O/ https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3 https://github.com/moment/moment/pull/6015#issuecomment-1152961973 https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/ https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html Common Vulnerability Exposure (CVE) ID: CVE-2023-28447 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P7O7SKTATM6GAP45S64QFXNLWIY5I7HP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HSAUM3YHWHO4UCJXRGRLQGPJAO3MFOZZ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBB35GLYTL6JL6EOM6BOZNYP47JKNNHT/ https://github.com/smarty-php/smarty/commit/685662466f653597428966d75a661073104d713d https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.