[GHSA-4f5x-q4jc-xfcf] pimcore/pimcore: patched version predates the fix (first fixed release: 10.2.9)

[zyl71]

Updates

• Affected products

Comments
Current record: Packagist:pimcore/pimcore: introduced=0 fixed=10.2.7
Proposed: Packagist:pimcore/pimcore: introduced=0 fixed=10.2.9

The record's fixed version 10.2.7 (released 2021-12-22) predates the fix: the media-query-name validation was committed 2022-01-17 (6f36e841) and merged into the 10.2 branch as 62d6ca67 (PR #11207) on 2022-01-19, and the Packagist dist shas of 10.2.7 (82dae690) and 10.2.8 (a23ccb2b) do not contain it. 10.2.9 (2022-01-19) is the first release with the code (the same release also adds htmlspecialchars on thumbnail group names). No other release line was active (6.9.x ended June 2021), so 0 -> 10.2.9 is right.

Release lines: Only the 10.2.x line was receiving releases around the fix (10.2.6 2021-12-09 ... 10.2.10 2022-02-02); it is fixed at 10.2.9. 10.3.0 (2022-02-02) contains the fix (compare v10.3.0...62d6ca67 = behind). The 6.9.x line ended with 6.9.6 on 2021-06-23, before the fix, so it stays entirely affected and is covered by 0 -> 10.2.9. No other line existed.

Upstream statements: on the huntr report the maintainer "marked this as fixed in 10.2.7 with commit 6f36e8", and the CVE-2022-0262 description says "prior to 10.2.7". Both are contradicted by the artifacts: 10.2.7 (2021-12-22) and 10.2.8 (2022-01-05) were published before the fix commit existed (2022-01-17) and neither contains the validation code; the first release carrying it is 10.2.9 (2022-01-19).

Evidence:

• https://repo.packagist.org/p2/pimcore/pimcore.json - v10.2.7 2021-12-22T11:32:24Z (ref 82dae690), v10.2.8 2022-01-05 (a23ccb2b), v10.2.9 2022-01-19T15:24:47Z (b432225952), v10.3.0 2022-02-02; last 6.9.x = v6.9.6 2021-06-23
• https://api.github.com/repos/pimcore/pimcore/commits/6f36e841ce55f67e2e95253dd58f80659ef166c7/pulls - PR #11207, base 10.2, merged 2022-01-19T10:24:54Z, merge_commit_sha 62d6ca67f1
• https://api.github.com/repos/pimcore/pimcore/compare/v10.2.9...62d6ca67f174a8a2dc34cd73fe9b9272f8222170 - status "behind" (the tag contains the merged fix); v10.2.8...62d6ca67 = ahead; v10.3.0...62d6ca67 = behind
• https://raw.githubusercontent.com/pimcore/pimcore/v10.2.9/bundles/AdminBundle/Controller/Admin/SettingsController.php - lines 1338-1339: preg_match('/["<>]/', $mediaName) / throw 'Invalid media query name'; the same file at v10.2.8 and at 82dae690 (the v10.2.7 dist sha) has 0 matches
• https://api.github.com/repos/pimcore/pimcore/commits/b432225952e2a5ab0268f401b85a14480369b835 - tag commit of v10.2.9: "[Thumbnails] Escape group text properly" (the extra htmlspecialchars hardening shipped in the same release)
• https://web.archive.org/web/2022id_/https://huntr.dev/bounties/b38a4e14-5dcb-4e49-9990-494dc2a8fa0d - Wayback copy of the huntr report: the maintainer marked it fixed in 10.2.7 with commit 6f36e8

Version checks:

• pimcore/pimcore 10.2.9 (Packagist 2022-01-19): contains the fix, via 62d6ca67f174a8a2dc34cd73fe9b9272f8222170 (PR #11207 "[Thumbnail] Validate media query name", merged into branch 10.2 on 2022-01-19). Method: compare API (v10.2.9...62d6ca67 = behind; v10.2.9...6f36e841 = diverged, because 6f36e841 is the unmerged PR-branch commit) plus the raw SettingsController.php and item.js at the tag. Previous release 10.2.8: does not contain the fix.
• pimcore/pimcore 10.2.7 (the record's declared fixed version, Packagist 2021-12-22): does not contain the fix. Method: the raw file at the Packagist dist sha 82dae690 has 0 matches for "Invalid media query name", and the release predates the fix commit (2022-01-17) by 26 days. Previous release 10.2.6: does not contain the fix.

This comes from a systematic comparison of advisory ranges with fix commits and published registry artifacts. Happy to adjust if the maintainers intend otherwise.