Skip to content

Conversation

RobXYZ
Copy link
Contributor

@RobXYZ RobXYZ commented Nov 29, 2024

Some additional security issues in phpoffice/phpspreadsheet were fixed in November.

+-------------------+----------------------------------------------------------------------------------+
| Package           | phpoffice/phpspreadsheet                                                         |
| Severity          | high                                                                             |
| CVE               | CVE-2024-48917                                                                   |
| Title             | XXE in PHPSpreadsheet's XLSX reader                                              |
| URL               | https://github.com/advisories/GHSA-7cc9-j4mv-vcjp                                |
| Affected versions | >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4                             |
| Reported at       | 2024-11-18T20:01:46+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | phpoffice/phpspreadsheet                                                         |
| Severity          | high                                                                             |
| CVE               | CVE-2024-47873                                                                   |
| Title             | XmlScanner bypass leads to XXE                                                   |
| URL               | https://github.com/advisories/GHSA-jw4x-v69f-hh5w                                |
| Affected versions | >=3.3.0,<3.4.0|>=2.2.0,<2.3.2|>=2.0.0,<2.1.3|<1.29.4                             |
| Reported at       | 2024-11-18T20:01:20+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

2.3.3 also incorporates this PR PHPOffice/PhpSpreadsheet#4233

fix #66

Copy link

@yajra yajra merged commit 569865f into yajra:master Nov 29, 2024
6 checks passed
@yajra
Copy link
Owner

yajra commented Nov 29, 2024

Thank you for your contribution, appreciate it. Release on v11.3.1 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

phpoffice/phpspreadsheet upgrade due to CVE-2024-48917 and CVE-2024-47873
2 participants