ezsystems/ezplatform

eZ Platform distribution

View on Packagist

View on Github

Activity

Latest release: 2y ago
Total releases: 266
Cadence: ~7 days
Last 12 months: 0

Reach

Stars: —

Details

License: unknown
First release: Feb 27, 2015

Releases

Version	Released
`v2.5.32` patch	Nov 03, 2023
`v2.5.31` patch	Nov 10, 2022
`v2.5.30` patch	May 31, 2022
`v2.5.29` patch	Apr 28, 2022
`v2.5.28` patch	Mar 21, 2022
`v2.5.27` patch	Jan 18, 2022
`v2.5.26` patch	Dec 21, 2021
`v2.5.25` patch	Oct 26, 2021
`v2.5.24.1` patch	Sep 14, 2021
`v1.13.6.1` patch	Sep 14, 2021
`v2.5.24` patch 1 CVE	Sep 10, 2021
`v2.5.23` patch 1 CVE	Aug 30, 2021
`v2.5.22` patch 1 CVE	Aug 02, 2021
`v2.5.21` patch 1 CVE	Jun 25, 2021
`v3.2.8` patch	Jun 02, 2021
`v2.5.20` patch 1 CVE	Jun 02, 2021
`v3.2.7` patch	May 13, 2021
`v2.5.19` patch 1 CVE	May 12, 2021
`v3.2.6` patch	Apr 22, 2021
`v2.5.18` patch 1 CVE	Apr 15, 2021
`v3.2.5` patch	Mar 11, 2021
`v2.5.17` patch 1 CVE	Mar 03, 2021
`v3.2.4` patch	Jan 21, 2021
`v3.1.5` patch	Jan 21, 2021
`v2.5.16` patch 1 CVE	Jan 20, 2021
`v3.2.3` patch	Dec 10, 2020
`v1.13.6` patch 1 CVE	Nov 26, 2020
`v3.2.2` patch	Nov 24, 2020
`v1.13.6-rc1` pre 1 CVE	Nov 17, 2020
`v2.5.15` patch 1 CVE	Nov 09, 2020
`v3.2.1` patch	Nov 03, 2020
`v3.1.4` patch	Oct 29, 2020
`v3.2.0` minor	Oct 23, 2020
`v3.2.0-rc1` pre	Oct 14, 2020
`v3.2.0-beta1` pre	Oct 06, 2020
`v3.1.3` patch	Oct 01, 2020
`v2.5.14` patch 1 CVE	Sep 30, 2020
`v3.1.2` patch	Sep 04, 2020
`v2.5.13` patch 1 CVE	Sep 04, 2020
`v3.1.1` patch	Jul 23, 2020
`v3.0.6` patch	Jul 21, 2020
`v3.1.0` minor	Jul 15, 2020
`v2.5.12` patch 1 CVE	Jul 13, 2020
`v3.1.0-rc2` pre	Jun 29, 2020
`v3.1.0-rc1` pre	Jun 23, 2020
`v3.1.0-beta1` pre	Jun 16, 2020
`v3.0.5` patch	Jun 12, 2020
`v2.5.11` patch 1 CVE	Jun 12, 2020
`v2.5.10` patch 1 CVE	May 29, 2020
`v3.0.4` patch	May 29, 2020

1–50 of 266

Repository

ezsystems/ezplatform

Forks: —
Open issues: —

Dependencies (38)

Depends on

v2.5.32

Used by

Supply-chain exposure

8 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (4)

GHSA-qhjc-hg94-245v May 15, 2024

eZ Platform Prevent accepting app.php in URL in Platform.sh

Medium

The recommended rewrite rules in eZ Platform prevent users from including the front-controller script (normally "app.php") in URLs. This prevents certain vulnerabilities related to caching. However, this is not possible when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service), nor can it be done within the .platform.app.yaml configuration file. Therefore we need to reject such requests in the application itself. This advisory adds the prevention within the front controller script itself.

If you use eZ Platform Cloud / Platform.sh we recommend that you install this security update as soon as possible. It is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2

Affected versions

v2.5.0v2.5.1v2.5.2v2.5.3v1.13.0v1.13.1v1.13.1-rc1v1.13.1.1v1.13.2v1.13.2-rc1v1.13.3v1.13.3-rc1

+ 32 more Show less

v1.13.4v1.13.4-beta1v1.13.4-rc1v1.13.4-rc2v1.13.4.1v1.13.5v1.13.5-rc1v1.13.5-rc2v1.7.0v1.7.1-rc1v1.7.2v1.7.2-rc1v1.7.2-rc2v1.7.3v1.7.3-rc1v1.7.3-rc2v1.7.4v1.7.4-rc1v1.7.5v1.7.5-rc1v1.7.5-rc2v1.7.6v1.7.6-rc1v1.7.7v1.7.7-rc1v1.7.7-rc2v1.7.8v1.7.8-rc1v1.7.8-rc2v1.7.8.1v1.7.9v1.7.9-rc1

Fixed in

1.7.9.11.13.5.12.5.4

References

https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2
https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-09-03-2.yaml
https://github.com/ezsystems/ezplatform
https://share.ez.no/community-project/security-advisories/ezsa-2019-007-prevent-accepting-app.php-in-url-in-platform.sh

Updated Nov 29, 2024 · Source: OSV.dev
GHSA-6xch-2vxx-5pvr May 15, 2024

eZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)

Medium

The recommended Apache/Nginx virtual host configuration for eZ Platform includes a rewrite rule for blocking access to executable files in the var directory. This rule does not work when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service).

The consequence of this is that in such a setup, those executable files may be downloadable. They will not be executable, unless you have specifically configured platform.sh to allow that (which you really should not do). The severity of the download access is limited, but it's better if the platform.sh cloud setup works the same way as regular eZ Platform does. All platform.sh setups are affected.

The fix adds a rule to the .platform.app.yaml configuration file, with the same effect as the rewrite rule already mentioned. After applying the fix, any attempt to access such files will fail with Access Denied. This security update is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/773dddc0d8fe4fda34d2153a401eeaa6cc30b1ff

Affected versions

v2.5.0v2.5.1v2.5.2v2.5.3v1.13.0v1.13.1v1.13.1-rc1v1.13.1.1v1.13.2v1.13.2-rc1v1.13.3v1.13.3-rc1

+ 32 more Show less

v1.13.4v1.13.4-beta1v1.13.4-rc1v1.13.4-rc2v1.13.4.1v1.13.5v1.13.5-rc1v1.13.5-rc2v1.7.0v1.7.1-rc1v1.7.2v1.7.2-rc1v1.7.2-rc2v1.7.3v1.7.3-rc1v1.7.3-rc2v1.7.4v1.7.4-rc1v1.7.5v1.7.5-rc1v1.7.5-rc2v1.7.6v1.7.6-rc1v1.7.7v1.7.7-rc1v1.7.7-rc2v1.7.8v1.7.8-rc1v1.7.8-rc2v1.7.8.1v1.7.9v1.7.9-rc1

Fixed in

1.7.9.11.13.5.12.5.4

References

https://github.com/ezsystems/ezplatform/commit/773dddc0d8fe4fda34d2153a401eeaa6cc30b1ff
https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-09-03-1.yaml
https://github.com/ezsystems/ezplatform
https://share.ez.no/community-project/security-advisories/ezsa-2019-006-rules-to-disable-executable-access-are-ignored-on-platform.sh-ez-cloud

Updated Nov 29, 2024 · Source: OSV.dev
GHSA-45qm-j4m9-whv9 May 15, 2024

eZ Platform CSRF token in login form is disabled by default

High

his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.

If you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the "csrf_token_generator" key to "security.csrf.token_manager", like this:

security: firewalls: ezpublish_front: form_login: csrf_token_generator: security.csrf.token_manager

NB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml

Affected versions

v2.5.0v2.5.1v2.5.2v2.5.3

Fixed in

2.5.4

References

https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezplatform/2019-06-27-1.yaml
https://github.com/ezsystems/ezplatform
https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default
https://web.archive.org/web/20210614185223/https://share.ez.no/community-project/security-advisories/ezsa-2019-004-csrf-token-in-login-form-is-disabled-by-default

Updated Nov 29, 2024 · Source: OSV.dev
GHSA-2rh5-jvgx-pgw3 Sep 14, 2021

Any storage file can be downloaded from p.sh if full server path is known

High

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.

Affected versions

v2.0.0v2.0.0.1v2.0.0.2v2.0.1v2.0.2v2.0.2-rc1v2.1.0v2.1.0-beta1v2.1.0-rc1v2.1.1v2.1.1-rc1v2.2.0

+ 205 more Show less

v2.2.0-beta1v2.2.0-rc1v2.2.1v2.2.2v2.2.3v2.2.3.1v2.3.0v2.3.0-beta1v2.3.0-rc1v2.3.0-rc2v2.3.1v2.3.2v2.3.2.1v2.3.2.2v2.4.0v2.4.0-beta1v2.4.0-rc1v2.4.1v2.4.2v2.4.2-rc1v2.5.0v2.5.0-beta1v2.5.0-beta2v2.5.0-rc1v2.5.0-rc2v2.5.1v2.5.10v2.5.11v2.5.12v2.5.13v2.5.14v2.5.15v2.5.16v2.5.17v2.5.18v2.5.19v2.5.2v2.5.20v2.5.21v2.5.22v2.5.23v2.5.24v2.5.3v2.5.4v2.5.5v2.5.6v2.5.7v2.5.7-rc1v2.5.8v2.5.8-rc1v2.5.9v2.5.9-rc1v2.5.9-rc21.2.0-rc61.2.0-rc71.9.1-rc2v0.11.0v0.5.0v0.5.1v0.7.0v0.9.0v0.9.1v0.9.1.1v0.9.2v1.0.0v1.0.0-beta1v1.0.0-beta10v1.0.0-beta2v1.0.0-beta3v1.0.0-beta4v1.0.0-beta5v1.0.0-beta6v1.0.0-beta7v1.0.0-beta8v1.0.0-beta9v1.0.0-rc1v1.0.1v1.1.0v1.1.0-rc1v1.1.0-rc2v1.1.0-rc3v1.10.0v1.10.0-beta1v1.10.0-beta2v1.10.0-beta3v1.10.0-rc1v1.10.0-rc2v1.10.1v1.10.1-rc1v1.11.0v1.11.0-beta1v1.11.0-rc1v1.11.0.1v1.12.0v1.12.0-beta1v1.12.0-beta2v1.12.0-rc1v1.12.1v1.12.1-rc1v1.12.1.1v1.12.2v1.13.0v1.13.0-beta1v1.13.0-beta2v1.13.0-rc1v1.13.1v1.13.1-rc1v1.13.1.1v1.13.2v1.13.2-rc1v1.13.3v1.13.3-rc1v1.13.4v1.13.4-beta1v1.13.4-rc1v1.13.4-rc2v1.13.4.1v1.13.5v1.13.5-rc1v1.13.5-rc2v1.13.5.1v1.13.5.2v1.13.6v1.13.6-rc1v1.2.0v1.2.0-rc2v1.2.0-rc3v1.2.0-rc4v1.2.0-rc5v1.3.0v1.3.0-beta1v1.3.0-rc1v1.3.0-rc2v1.3.1v1.3.1-rc1v1.3.2v1.3.2-rc1v1.3.3v1.3.3-rc1v1.4.0v1.4.0-beta1v1.4.0-rc1v1.4.1v1.4.1-rc1v1.4.1-rc2v1.4.2v1.4.2-rc1v1.4.2-rc2v1.4.2-rc3v1.5.0v1.5.0-beta1v1.5.0-beta2v1.5.0-rc1v1.5.0-rc2v1.5.1v1.5.1-rc1v1.5.2v1.5.2-rc1v1.6.0v1.6.0-alpha1v1.6.0-beta1v1.6.0-rc1v1.6.0.1v1.6.1v1.6.1-rc1v1.7.0v1.7.0-beta1v1.7.0-beta2v1.7.0-beta3v1.7.0-rc1v1.7.1-rc1v1.7.2v1.7.2-rc1v1.7.2-rc2v1.7.3v1.7.3-rc1v1.7.3-rc2v1.7.4v1.7.4-rc1v1.7.5v1.7.5-rc1v1.7.5-rc2v1.7.6v1.7.6-rc1v1.7.7v1.7.7-rc1v1.7.7-rc2v1.7.8v1.7.8-rc1v1.7.8-rc2v1.7.8.1v1.7.9v1.7.9-rc1v1.7.9.1v1.8.0v1.8.0-beta1v1.8.0-rc1v1.8.1v1.8.1-rc1v1.9.0v1.9.0-beta1v1.9.0-beta2v1.9.0-rc1v1.9.1v1.9.1-rc1

Fixed in

1.13.6.12.5.24.1

References

https://github.com/ezsystems/ezplatform/security/advisories/GHSA-2rh5-jvgx-pgw3
https://developers.ibexa.co/security-advisories/ibexa-sa-2021-006-storage-and-legacy-files-accessible-if-path-is-known
https://github.com/ezsystems/ezplatform

Updated Dec 02, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 3
minor 23
patch 108
pre 131

266 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2023

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More