GitHub Advisoryadvisory · Packagist

GHSA-484f-743f-6jx2 Object injection in cookie driver in phpfastcache

MEDIUM Published 2019-12-12 Modified 2022-07-05 Official page ↗
Aliases
CVE-2019-16774
Ecosystem
Packagist
Packages
phpfastcache/phpfastcache
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-94
Reviewed
2020-06-16

Affected packages

• Packagist phpfastcache/phpfastcache: >= 5.0.0, < 5.0.13 → fixed in 5.0.13

Description

Impact An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases). Patches The issue has been addressed by enforcing JSON conversion when deserializing Workarounds If you can't fix it, use another driver such as "Files" (Filesystem) References Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13 For more information If you have any questions or comments about this advisory: • Open an issue in the issue tracker • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2019-16774 In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References