CSIRT Panam\u00e1 Aviso 2020-07-14 PHP: Vulnerabilidad y mitigaci\u00f3n para PHP Mailer.<\/p>\n\n\n\n
Gravedad: Media
Vulnerabilidad: CVE-2020-13625
Fecha de publicaci\u00f3n: Julio 14, 2020
\u00daltima revisi\u00f3n: Julio 14, 2020
Portal: https:\/\/www.php.net
Sistemas Afectados: PHPMailer versi\u00f3n 6.1.5 y anteriores.<\/p>\n\n\n\n
I. Descripci\u00f3n
Vulnerabilidad que afecta a su servidor de correo, mediante afectaci\u00f3n al PHPMailer.<\/p>\n\n\n\n
II. Impacto
Vulnerabilidad: CVE-2020-13625
Es posible enga\u00f1ar a filtros de correo modificando el nombre del archivo adjunto, en donde la utilizar el nombre \u2019filename.html\u00bb;.jpg\u2019, el formato del archivo ser\u00eda HTML en vez de JPG (la \u00faltima parte ser\u00eda ignorada), por lo que si ciertos filtros no permit\u00edan un tipo de archivo, se pod\u00eda utilizar este m\u00e9todo para enviar un tipo v\u00e1lido y evadir las medidas de seguridad. <\/p>\n\n\n\n
III. Referencia a soluciones, herramientas e informaci\u00f3n
Se recomienda actualizar a la versi\u00f3n 6.1.6 de PHPMailer (https:\/\/github.com\/PHPMailer\/PHPMailer\/releases\/tag\/v6.1.6).
Fuentes:
Common Vulnerabilities and Exposures (CVE). Recopilado en: https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-13625
GitHub. 2020-05-26 Insufficient output escaping of attachment names. 27 de mayo del 2020. Recopilado en: https:\/\/github.com\/PHPMailer\/PHPMailer\/security\/advisories\/GHSA-f7hx-fqxw-rvvj
CSIRT Chile. 9 de julio del 2020. Vulnerabilidades. Recopilado en: https:\/\/www.csirt.gob.cl\/vulnerabilidades\/9vsa20-00266-01\/<\/p>\n\n\n\n
Informaci\u00f3n de contacto
\nCSIRT PANAMA
\nComputer Security Incident Response Team Autoridad Nacional para la Innovacion Gubernamental
\nE-Mail: info@cert.pa
\nPhone: +507 520-CERT (2378)
\nWeb: https:\/\/cert.pa
\nTwitter: @CSIRTPanama
\nKey ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"
CSIRT Panam\u00e1 Aviso 2020-07-14 PHP: Vulnerabilidad y mitigaci\u00f3n para PHP Mailer. Gravedad: Media Vulnerabilidad: CVE-2020-13625 Fecha de publicaci\u00f3n: Julio 14, 2020 \u00daltima revisi\u00f3n: Julio 14, 2020 Portal: https:\/\/www.php.net Sistemas Afectados: PHPMailer versi\u00f3n 6.1.5 y anteriores….<\/p>\n","protected":false},"author":4,"featured_media":2249,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[72,104],"class_list":["post-2248","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-avisos-de-seguridad","tag-php"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2248"}],"version-history":[{"count":2,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2248\/revisions"}],"predecessor-version":[{"id":2251,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2248\/revisions\/2251"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/2249"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2248"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2248"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}