This is a meta issue to track updating the module code to work with the latest PHPMailer releases.

For 7.x prior work exists at #2692585: PHP 5.6 upgrade and SMTP incompatibility (updated phpmailer)

For 8.x prior work exists at #2711559: Set phpMailer as a external library using composer (and update it to 6.0)

Comments

greggles created an issue. See original summary.

ws.agency’s picture

ws.agency commented
Version: 7.x-2.x-dev » 8.x-1.x-dev

There is a critical vulnerability (CVE-2016-10033) in PhpMailer library which affects all versions prior to 5.2.18
https://github.com/PHPMailer/PHPMailer/issues/922

Currently Drupal 8.x version of this module ships with version 5.1. Is it possible to update library to latest one?

wundo’s picture

wundo commented

We're not affected by DRUPAL-SA-PSA-2016-004, but yes we can update 8.x, I suggest we handle that in a different issue

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
commented

Yes, the separate issue for it is #2711559: Set phpMailer as a external library using composer (and update it to 6.0).

estoyausente’s picture

estoyausente
Primary language Spanish
commented

Can we set https://www.drupal.org/node/2711559 as a childen issue? Or do you prefer update the library setting it inside our code?

I think that we have to use composer or change the install instructions but we have to remove PHPMailer library from our git repo while we update it.

blasthaus’s picture

blasthaus commented

Also need to address:

PHPMailer versions prior to 5.2.20 (released December 28th 2016) are vulnerable to CVE-2016-10045 a remote code execution vulnerability.

PHPMailer versions prior to 5.2.22 (released January 9th 2017) have a local file disclosure vulnerability, CVE-2017-5223. If content passed into msgHTML() is sourced from unfiltered user input, relative paths can map to absolute local file paths and added as attachments. Also note that addAttachment (just like file_get_contents, passthru, unlink, etc) should not be passed user-sourced params either!

tr’s picture

tr commented
Version: 8.x-1.x-dev » 7.x-1.x-dev
Priority: Critical » Normal
Status: Active » Closed (outdated)

This issue is no longer relevant to the 8.x-1.x branch. See #3151530: PHPMailer library 6.1.5 or higher is required

Also, moving from a forked version of PHPMailer to the latest version in D7 is being discussed in #2295773: D7.x: Update PHPMailer to v6.0, which is older than this meta issue. I don't see the need to have two issues open for the D7 case.