Phpmailer security update (v5.2.21)

[Yuliya Bozhko]

PHPMailer just released fixes for some serious security issues. For more details, see https://github.com/PHPMailer/PHPMailer/wiki/About-the-CVE-2016-10033-and-CVE-2016-10045-vulnerabilities

Not sure to what extent Mahara might be affected, but would suggest to upgrade all supported branches.

[Kristina Hoeppner (kris-hoeppner)]

Thanks Yuliya.

[Kristina Hoeppner (kris-hoeppner)]

Apparently, there is new vulnerability in PHPmailer. So we are looking into fixing the immediate issue.

[Kristina Hoeppner (kris-hoeppner)]

5.2.21 should fix the issue. Dan recommended to improve the validation though as well.

[Yuliya Bozhko (yuliya.bozhko)]

Version 5.2.21 is just a version mismatch without any functionality change. The real fix is in 5.2.20.

Moodle has a public security issue open for this as well if you would like to check the discussions there https://tracker.moodle.org/browse/MDL-57531.

At Totara, Petr had a look at this PHPMailer release and concluded that it is going to break sending emails with non-standard email addresses if the systems are not configuring custom SMTP servers. Something to be considered as well.

Another thing mentioned was that we should make sure that noreply address is never empty.

Hope it helps.

[Kristina Hoeppner (kris-hoeppner)]

All supported versions of Mahara (15.04, 15.10, 16.04 and 16.10 now have PHPMailer 5.2.21. Any further enhancements will be reviewed. Mahara automatically takes the wwwroot as domain for the noreply address.

[Javier J. Salmeron Garcia (jsalmeron)]

Hi,

I see that you use Zend_Mail in some parts of the code. Zend Mail is also affeted by the security issue: pwnscriptum.com. Could you confirm if the application is vulnerable?

[Cecilia Vela Gurovic (ceciliavg)]

Hi All,

Zend Mail is not being used in Mahara. We do have Zend library, but the part that references Zend Mail is not being used.

We made a bug report to delete it here:

https://bugs.launchpad.net/mahara/+bug/1655150