CVEvulnerability
CVE-2019-18889
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-11-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Affected configurations
• sensiolabs symfony (>= 3.4.0 <= 3.4.34)
• sensiolabs symfony (>= 4.2.0 <= 4.2.11)
• sensiolabs symfony (>= 4.3.0 <= 4.3.7)
• fedoraproject fedora 31
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://github.com/symfony/symfony/releases/tag/v4.3.8 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/ lists.fedoraproject.org
- https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances Vendor Advisory
- https://symfony.com/blog/symfony-4-3-8-released Release Notes
- https://github.com/symfony/symfony/releases/tag/v4.3.8 Release Notes
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/ lists.fedoraproject.org
- https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances Vendor Advisory
- https://symfony.com/blog/symfony-4-3-8-released Release Notes