GHSA-699q-wcff-g9mj Unsafe deserialization in Yii 2

• Packagist yiisoft/yii2: < 2.0.38 → fixed in 2.0.38

Impact Remote code execution in case application calls `unserialize()` on user input containing specially crafted string. Patches 2.0.38 Workarounds Add the following to BatchQueryResult.php: ```php public function __sleep() { throw new \BadMethodCallException('Cannot serialize '.__CLASS__); } public function __wakeup() { throw new \BadMethodCallException('Cannot unserialize '.__CLASS__); } ``` For more information If you have any questions or comments about this advisory, contact us through security form.