USN-6550-1

See a problem?
Source
https://ubuntu.com/security/notices/USN-6550-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6550-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-6550-1
Related
Published
2023-12-12T12:15:17.295752Z
Modified
2023-12-12T12:15:17.295752Z
Summary
postfixadmin vulnerabilities
Details

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly sanitizing user input when generating templates. An attacker could, through PHP injection, possibly use this issue to execute arbitrary code. (CVE-2022-29221)

It was discovered that Moment.js, that is integrated in the PostfixAdmin code, was using an inefficient parsing algorithm when processing date strings in the RFC 2822 standard. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-31129)

It was discovered that Smarty, that is integrated in the PostfixAdmin code, was not properly escaping JavaScript code. An attacker could possibly use this issue to conduct cross-site scripting attacks (XSS). (CVE-2023-28447)

References

Affected packages

Ubuntu:Pro:18.04:LTS / postfixadmin

Package

Name
postfixadmin
Purl
pkg:deb/ubuntu/postfixadmin@3.0.2-2ubuntu0.1~esm1?arch=src?distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.2-2ubuntu0.1~esm1

Affected versions

3.*

3.0.2-2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "postfixadmin": "3.0.2-2ubuntu0.1~esm1"
        }
    ]
}

Ubuntu:Pro:20.04:LTS / postfixadmin

Package

Name
postfixadmin
Purl
pkg:deb/ubuntu/postfixadmin@3.2.1-3ubuntu0.1~esm1?arch=src?distro=esm-apps/focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.1-3ubuntu0.1~esm1

Affected versions

3.*

3.2.1-2
3.2.1-3

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "postfixadmin": "3.2.1-3ubuntu0.1~esm1"
        }
    ]
}

Ubuntu:Pro:22.04:LTS / postfixadmin

Package

Name
postfixadmin
Purl
pkg:deb/ubuntu/postfixadmin@3.3.10-2ubuntu0.1~esm1?arch=src?distro=esm-apps/jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.3.10-2ubuntu0.1~esm1

Affected versions

3.*

3.3.7-1
3.3.10-2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "postfixadmin": "3.3.10-2ubuntu0.1~esm1"
        }
    ]
}