WordPress.org

Make WordPress Core

Opened 21 months ago

Last modified 3 days ago

#40472 new enhancement

Update PHPMailer to 5.2.27

Reported by: MattyRob Owned by:
Milestone: Awaiting Review Priority: normal
Severity: critical Version: 4.8
Component: External Libraries Keywords: has-patch dev-feedback
Focuses: Cc:

Description

There is a minor maintenance release for PHPMailer that we should consider patching to. https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.23

Attachments (7)

40472.diff (6.7 KB) - added by MattyRob 21 months ago.
40472v2.diff (10.2 KB) - added by MattyRob 18 months ago.
40472v3.diff (74.2 KB) - added by MattyRob 17 months ago.
40472v4.diff (338.3 KB) - added by MattyRob 15 months ago.
40472v5.diff (338.1 KB) - added by MattyRob 13 months ago.
40472v6.diff (338.9 KB) - added by MattyRob 2 months ago.
Patch also fixes indents to tabs.
45838-phpmailer-5-2-27-upgrade.patch (6.6 KB) - added by ayeshrajans 12 days ago.
Hello everyone, This is rather clean patch of PHPMailer v5.2.22...v5.2.27.

Download all attachments as: .zip

Change History (38)

@MattyRob
21 months ago

#1 @MattyRob
21 months ago

  • Keywords has-patch needs-testing added
  • Severity changed from normal to minor

#2 @lukecavanagh
21 months ago

40472.diff Patch applies cleanly.

#3 @MattyRob
21 months ago

  • Keywords needs-testing removed

I've tested emails and everything appears functional with the patch and PHP Unit Tests all pass in the mail test suite.

#4 @Presskopp
18 months ago

FYI: 5.2.24 is current (fixing also a security issue, that doesn't affect WordPress, as far as i can tell)

#5 @MattyRob
18 months ago

  • Keywords needs-testing added
  • Summary changed from Update PHPMailer to 5.2.23 to Update PHPMailer to 5.2.24

@MattyRob
18 months ago

#6 @Presskopp
17 months ago

  • Summary changed from Update PHPMailer to 5.2.24 to Update PHPMailer to 5.2.25

Version 5.2.25 (August 28th 2017)

Make obtaining SMTP transaction ID more reliable

Add Bosnian translation

This is the last official release in the legacy PHPMailer 5.2 series; there may be future security patches (which will be found in the 5.2-stable branch), but no further non-security PRs or issues will be accepted.

Migrate to PHPMailer 6.0.

@MattyRob
17 months ago

#7 @netweb
17 months ago

Related: #41750 Update PHPMailer to 6.0

#8 @peopleinside
16 months ago

  • Severity changed from minor to normal

Hi, cirrently I can see mail come out from Wordpress from PHP Mailer 5.2.22 that has security vulnerability.

I AM asking when this will be fixed with update in Wordpress. Thank you.

I AM using plugin SMTP Mailer and opened an issue but the plug in athir says that the plugin use Wordpress PHP Mailer so Wordpress PHP Mailer seems to be vulnerable, 5.2.22 https://wordpress.org/support/topic/php-mailer-vulnerability/#post-9563243

On PHP Mailer 5.2.24 SECURITY Fix XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a .phps extension, so it it not normally executable unless it is explicitly renamed, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

#9 follow-up: @bgermann
16 months ago

CVE-2017-11503 is not an issue for WordPress, because the example is not included. BUT the potential XSS vulnerability may be an issue. The fix can be seen at https://github.com/PHPMailer/PHPMailer/commit/d46ba2d186.

It does not need much time to integrate the existing (!) patch, but it would take much time to ensure, WordPress is not affected by this. So why not integrate the patch? Please!

#10 in reply to: ↑ 9 @aaroncampbell
15 months ago

  • Severity changed from normal to minor

I took a look through our code and it doesn't look like we use the phpmailerException::errorMessage() helper function anywhere, which would mean the reported potential XSS doesn't affect WordPress core.

I'm of the general opinion that keeping our libraries up to date is good, it's just not security related in this case.

As a side note, if it was a valid security issue it should really be reported to https://hackerone.com/wordpress and not discussed publicly here on Trac.

@MattyRob
15 months ago

#12 @MattyRob
15 months ago

  • Severity changed from minor to major

@Presskopp

I believe it may pose a risk but should not cause issues in the default WordPress configuration, patch updated.

Last edited 15 months ago by MattyRob (previous) (diff)

#13 @rogueresearch
13 months ago

I'm using WordPress 4.9.1 (current) and started evaluating the Ninja Forms plugin (which can send emails). In the headers of the emails it generates, I see:

X-Mailer: PHPMailer 5.2.22 (https://github.com/PHPMailer/PHPMailer)

This concerned me because:

1) 5.2.22 is a year old (2017-01-09). 2) 5.2 branch is only getting security updates at this point. 3) 5.2.24 has security fixes (CVE-2017-11503). 3) 5.2.26 is current (2017-11-04) and contains another security fix.

Even if the security issue doesn't affect the WP core, might it not affect plugins?

@MattyRob : I tried to look at your patch, but it seems there was a space<->tab change, making it difficult to review.

What is required to move this along? I could help with testing...

@MattyRob
13 months ago

#14 @rogueresearch
13 months ago

40472v5.diff still has the space<->tab changes, but nevertheless the patch applies correctly. I'm now trying it on my test server...

#15 @bgermann
13 months ago

  • Summary changed from Update PHPMailer to 5.2.25 to Update PHPMailer to 5.2.26

#16 @MattyRob
13 months ago

  • Summary changed from Update PHPMailer to 5.2.26 to Update PHPMailer to 5.2.25

@rogueresearch

Try the updated patch - hopefully that'll work better for you.

Apologies, late post as I slept my computer too fast this morning. I see you are testing now.

Last edited 13 months ago by MattyRob (previous) (diff)

#17 @MattyRob
13 months ago

  • Summary changed from Update PHPMailer to 5.2.25 to Update PHPMailer to 5.2.26

#18 @rogueresearch
13 months ago

I've tested, and it seems to work just fine for me. I'm not doing anything very fancy, just using the Ninja Forms plugin, and it's successfully sending email and the "X-Mailer:" header indeed shows 5.2.26 now.

#19 @MattyRob
13 months ago

  • Keywords dev-feedback added; needs-testing removed

I've tested for a few weeks and am getting notifications about comments, from the Stop Spammers plugin and also from Subscribe2 for post notifications. Checked on 2 installs.

#20 @rogueresearch
12 months ago

Did this get into WP 4.9.2?

#21 @bgermann
12 months ago

No, it did not.

#22 follow-up: @rogueresearch
12 months ago

So we have 1) a patch 2) testing completed on several installs by several people

What more is needed to get this in WordPress?!

#23 in reply to: ↑ 22 @slaFFik
12 months ago

Replying to rogueresearch:

So we have 1) a patch 2) testing completed on several installs by several people

What more is needed to get this in WordPress?!

#courage :)

---

@SergeyBiryukov Sorry for bringing you here, but can you please take a look?

#24 @rogueresearch
7 months ago

Is there any paid support to get this fixed?

#25 @here
2 months ago

New version available 5.2.27 including a security vulnerability patch. Note also that PHPMailer v5.2.x reaches end of life at end of 2018 and will no longer receive security updates.

https://github.com/PHPMailer/PHPMailer/blob/master/SECURITY.md

#26 @bgermann
2 months ago

  • Severity changed from major to critical
  • Summary changed from Update PHPMailer to 5.2.26 to Update PHPMailer to 5.2.27

@MattyRob
2 months ago

Patch also fixes indents to tabs.

#27 @rogueresearch
2 months ago

@MattyRob thank for updating the patch. I've installed it on my test server and tried it with the NinjaForms plugin. It seems to work fine. And the email header reflects the new version:

X-Mailer: PHPMailer 5.2.27 (https://github.com/PHPMailer/PHPMailer)

#28 @bgermann
2 months ago

Every wp_mail call with the $attachments parameter set is vulnerable to CVE-2018-19296. WP Core does not call wp_mail with $attachments. But plugins that do and have no mitigating check in place are vulnerable.

#29 @ocean90
12 days ago

#45838 was marked as a duplicate.

@ayeshrajans
12 days ago

Hello everyone, This is rather clean patch of PHPMailer v5.2.22...v5.2.27.

#30 @slaFFik
3 days ago

I would love to see this coming in the next WordPress release.

#31 @rogueresearch
3 days ago

This ticket has been an enlightening experience:

  • there have been patches
  • they have been tested
  • it's a security issue
  • I've offered to pay

And yet nothing happens. I understand now why WordPress has a reputation for horrible security!

Note: See TracTickets for help on using tickets.