Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.3] Update SwiftMailer #17131

Merged
merged 1 commit into from
Jan 4, 2017
Merged

[5.3] Update SwiftMailer #17131

merged 1 commit into from
Jan 4, 2017

Conversation

bmitch
Copy link
Contributor

@bmitch bmitch commented Jan 4, 2017

This is due to the vulnerability discovered in SwiftMailer which is now fixed in 5.4.5:

swiftmailer/swiftmailer#847

https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html

@GrahamCampbell
Copy link
Member

This won't actually affect security at all, because composer will just resolve an earlier version of laravel if someone wants to install an older swiftmailer.

@GrahamCampbell
Copy link
Member

Please send to the 5.4 branch here, so that 5.4.x will force the new version of swiftmailer. Also, please update all our composer.json files in this repo. The only other file should be in laravel/framework/src/Mail, but please check for any others I could have forgotten about.

@GrahamCampbell
Copy link
Member

Also, this vulnerability probably affects nearly nobody using laravel, because use of smtp, or guzzle powered drivers is much more common.

@taylorotwell taylorotwell reopened this Jan 4, 2017
@taylorotwell taylorotwell merged commit d75cafc into laravel:5.3 Jan 4, 2017
@barryvdh
Copy link
Contributor

barryvdh commented Jan 4, 2017

Should we deprecate/remove the mail() method? As it's now also deprecated in swiftmailer?

@GrahamCampbell
Copy link
Member

I already removed it from the list of config options in the 5.4 boilerplate. We can probably remove support entirely in L5.5.

@GrahamCampbell GrahamCampbell changed the title Update SwiftMailer [5.3] Update SwiftMailer Jan 4, 2017
@barryvdh
Copy link
Contributor

barryvdh commented Jan 4, 2017

I would officially deprecate it in the docs/code then, so we can remove it without anybody complaining about it ;)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants