[GHSA-3xxm-3g3c-w579] moodle/moodle: backports to 3.9.24, 3.11.17, 4.0.11, 4.1.6, 4.2.3 not reflected

[zyl71]

Updates

• Affected products

Comments
Current record: Packagist:moodle/moodle: introduced=0 fixed=4.3.0-rc2
Proposed: Packagist:moodle/moodle: introduced=0 fixed=3.9.24 | introduced=3.10.0-beta fixed=3.11.17 | introduced=4.0.0-beta fixed=4.0.11 | introduced=4.1.0-beta fixed=4.1.6 | introduced=4.2.0-beta fixed=4.2.3 | introduced=4.3.0-beta fixed=4.3.0-rc2

The record marks every moodle/moodle version below 4.3.0-rc2 as vulnerable, but MDL-79408 shipped in the 2023-10-07 security release on all supported branches: each of v3.9.24, v3.11.17, v4.0.11, v4.1.6, v4.2.3 carries a cherry-pick of ba974a4a (verified by the commit on the tag and by the unserialize_object() change in the tagged files), while the preceding release on each branch does not. This matches the Moodle security advisory (MSA-23-0031) and NVD. The new lower bounds are the first Packagist version of each line (3.10.0-beta, 4.0.0-beta, 4.1.0-beta, 4.2.0-beta), because with plain x.y.0 the vulnerable betas/RCs of those lines (3.10.0-beta/rc1/rc2, 4.0.0-beta/rc1-rc4, 4.1.0-beta/rc1-rc3, 4.2.0-beta/rc1/rc2, all published before the fix) would sort below the lower bound and fall outside every range.

Release lines: Lines with releases around the 2023-10-07 security release: 3.9 (LTS, fixed 3.9.24; 3.9.25 later), 3.10 (ended 2022-05-07 with 3.10.11, never fixed -> stays inside [3.10.0-beta,3.11.17)), 3.11 (fixed 3.11.17), 4.0 (fixed 4.0.11), 4.1 (fixed 4.1.6), 4.2 (fixed 4.2.3), 4.3 (pre-release line: beta 2023-09-23 and rc1 2023-10-03 vulnerable, rc2 2023-10-06 fixed, 4.3.0 final 2023-10-07 fixed). All lines <=3.8 ended before the fix and are covered by [0,3.9.24). The '>= x.y.0-beta' notation is already used in existing moodle/moodle ranges in this database (223 of the 1322 moodle/moodle ranges, including 42 that start at '>= 4.3.0-beta').

Maintainer statements: Moodle MSA-23-0031 (mirrored in RH bug 2243352 and in NVD's CPE data): affects 4.2 to 4.2.2, 4.1 to 4.1.5, 4.0 to 4.0.10, 3.11 to 3.11.16, 3.9 to 3.9.23 and earlier unsupported versions; fixed in 4.2.3, 4.1.6, 4.0.11, 3.11.17, 3.9.24. That agrees with the proposed ranges; the record's single '< 4.3.0-rc2' range does not.

Evidence:

• https://repo.packagist.org/p2/moodle/moodle.json - v3.9.24, v3.11.17, v4.0.11, v4.1.6, v4.2.3 published 2023-10-07; v4.3.0-rc2 2023-10-06; v4.3.0-rc1 2023-10-03; x.y.0-beta versions exist for 3.10, 4.0, 4.1, 4.2, 4.3
• https://api.github.com/repos/moodle/moodle/commits?sha=v3.9.24&path=mod/lesson/locallib.php&since=2023-08-01T00:00:00Z - backport 7f2b1cba3d MDL-79408 on v3.9.24 (same query on v3.9.23 returns nothing); analogous for c7728de187/v3.11.17, de05fca77a/v4.0.11, f428d58df6/v4.1.6, 8bb0d14c8e/v4.2.3
• https://api.github.com/repos/moodle/moodle/compare/v4.3.0-rc2...ba974a4add981743b5a37c5bcc4714c62f6052ce - behind 78 -> rc2 contains the master fix; v4.3.0-rc1 is 'ahead 9, behind 0' (does not)
• https://raw.githubusercontent.com/moodle/moodle/v3.9.24/mod/lesson/locallib.php - unserialize_object() present at every fixed tag (locallib=2, essay=2, mod_form=1) and absent at v3.9.23, v3.11.16, v4.0.10, v4.1.5, v4.2.2, v4.3.0-rc1
• https://bugzilla.redhat.com/show_bug.cgi?id=2243352 - 'This flaw affects versions 4.2 to 4.2.2, 4.1 to 4.1.5, 4.0 to 4.0.10, 3.11 to 3.11.16, 3.9 to 3.9.23'; Fixed In Version: moodle 4.2.3, moodle 4.1.6, moodle 4.0.11, moodle 3.11.17, moodle 3.9.24; the bug title gives the Moodle advisory id (MSA-23-0031)
• https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-5539 - CPE ranges <3.9.24, 3.11.0-<3.11.17, 4.0.0-<4.0.11, 4.1.0-<4.1.6, 4.2.0-<4.2.3
• https://api.github.com/advisories?ecosystem=composer&affects=moodle/moodle - 223 of the 1322 existing moodle/moodle ranges already use a '>= x.y.0-beta' lower bound

Version checks:

• moodle/moodle 3.9.24 (registry 2023-10-07): contains fix: yes via backport 7f2b1cba3d; method: backport-diff + raw-file grep at tag (unserialize_object() in mod/lesson/locallib.php, pagetypes/essay.php, mod_form.php); compare-api vs master commit ba974a4a is 'diverged'; previous 3.9.23: no
• moodle/moodle 3.11.17 (registry 2023-10-07): contains fix: yes via backport c7728de187; method: backport-diff + raw-file grep at tag (unserialize_object() in mod/lesson/locallib.php, pagetypes/essay.php, mod_form.php); compare-api vs master commit ba974a4a is 'diverged'; previous 3.11.16: no
• moodle/moodle 4.0.11 (registry 2023-10-07): contains fix: yes via backport de05fca77a; method: backport-diff + raw-file grep at tag (unserialize_object() in mod/lesson/locallib.php, pagetypes/essay.php, mod_form.php); compare-api vs master commit ba974a4a is 'diverged'; previous 4.0.10: no
• moodle/moodle 4.1.6 (registry 2023-10-07): contains fix: yes via backport f428d58df6; method: backport-diff + raw-file grep at tag (unserialize_object() in mod/lesson/locallib.php, pagetypes/essay.php, mod_form.php); compare-api vs master commit ba974a4a is 'diverged'; previous 4.1.5: no
• moodle/moodle 4.2.3 (registry 2023-10-07): contains fix: yes via backport 8bb0d14c8e; method: backport-diff + raw-file grep at tag (unserialize_object() in mod/lesson/locallib.php, pagetypes/essay.php, mod_form.php); compare-api vs master commit ba974a4a is 'diverged'; previous 4.2.2: no
• moodle/moodle 4.3.0-rc2 (registry 2023-10-06): contains fix: yes; method: compare-api (v4.3.0-rc2...ba974a4a = behind 78); raw-file grep; previous 4.3.0-rc1 (2023-10-03): no (compare-api: ahead 9, behind 0; raw grep 0 hits)

This comes from a systematic comparison of advisory ranges with fix commits and published registry artifacts. Happy to adjust if the maintainers intend otherwise.