Information disclosure in Twig - CVE-2019-9942

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to sandbox information disclosure via the __toString() method call on an object that even can be disabled by the security policy in place. A remote attacker can gain unauthorized access to sensitive information on the system.

Affected software

How to mitigate CVE-2019-9942

External References

• https://symfony.com/blog/twig-sandbox-information-disclosure
• https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077
• https://www.debian.org/security/2019/dsa-4419
• https://seclists.org/bugtraq/2019/Mar/60

Related Security Bulletins

• Information disclosure in Symfony Twig
• Ubuntu update for php-twig