UBUNTU-CVE-2024-51754

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-51754

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-51754.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-51754

Related

Published

2024-11-06T20:15:00Z

Modified

2025-05-28T17:46:30Z

Summary

[none]

Details

Twig is a template language for PHP. In a sandbox, an attacker can call __toString() on an object even if the __toString() method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

References

Affected packages

Ubuntu:Pro:16.04:LTS / twig

Package

Name: twig
Purl: pkg:deb/ubuntu/twig@1.23.1-1ubuntu4+esm1?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.20.0-1

1.23.1-1ubuntu1

1.23.1-1ubuntu4

1.23.1-1ubuntu4+esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:18.04:LTS / twig

Package

Name: twig
Purl: pkg:deb/ubuntu/twig@2.4.6-1ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.24.0-2ubuntu1

2.*

2.4.4-2ubuntu1

2.4.6-1

2.4.6-1ubuntu0.1~esm1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:20.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@2.12.5-1?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.11.3-2

2.12.1-1

2.12.2-1

2.12.3-1

2.12.5-1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:20.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@2.12.5-1ubuntu0.1~esm2?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.12.5-1ubuntu0.1~esm2

Affected versions

2.*

2.11.3-2

2.12.1-1

2.12.2-1

2.12.3-1

2.12.5-1

2.12.5-1ubuntu0.1~esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-cssinliner-extra"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-doc"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-extra-bundle"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-html-extra"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-inky-extra"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-intl-extra"
        },
        {
            "binary_version": "2.12.5-1ubuntu0.1~esm2",
            "binary_name": "php-twig-markdown-extra"
        }
    ]
}

Ubuntu:22.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@3.3.8-2ubuntu4?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.3.2-1ubuntu3

3.3.4-1

3.3.6-1

3.3.7-1

3.3.8-2ubuntu4

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:22.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@3.3.8-2ubuntu4+esm2?arch=source&distro=esm-apps/jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.8-2ubuntu4+esm2

Affected versions

3.*

3.3.2-1ubuntu3

3.3.4-1

3.3.6-1

3.3.7-1

3.3.8-2ubuntu4

3.3.8-2ubuntu4+esm1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-cache-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-cssinliner-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-doc"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-extra-bundle"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-html-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-inky-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-intl-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-markdown-extra"
        },
        {
            "binary_version": "3.3.8-2ubuntu4+esm2",
            "binary_name": "php-twig-string-extra"
        }
    ]
}

Ubuntu:24.10 / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@3.8.0-3ubuntu1?arch=source&distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.8.0-2

3.8.0-3

3.8.0-3ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:24.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@3.8.0-2ubuntu1?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.7.0-1

3.7.1-1

3.8.0-2

3.8.0-2ubuntu1

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:24.04:LTS / php-twig

Package

Name: php-twig
Purl: pkg:deb/ubuntu/php-twig@3.8.0-2ubuntu0.1~esm1?arch=source&distro=esm-apps/noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.0-2ubuntu0.1~esm1

Affected versions

3.*

3.7.0-1

3.7.1-1

3.8.0-2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-cache-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-cssinliner-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-doc"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-extra-bundle"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-html-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-inky-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-intl-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-markdown-extra"
        },
        {
            "binary_version": "3.8.0-2ubuntu0.1~esm1",
            "binary_name": "php-twig-string-extra"
        }
    ]
}