GitHub Advisoryadvisory · Packagist
GHSA-6pjm-hmvf-h4rr image-optimizer allows PHAR deserialization
HIGH
Official page ↗
- Aliases
- CVE-2024-34515
- Ecosystem
- Packagist
- Packages
- spatie/image-optimizer
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2024-05-06
Affected packages
• Packagist spatie/image-optimizer: < 1.7.3 → fixed in 1.7.3
Description
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the `phar://` protocol in arguments to `file_exists()`.
Related
Alias · CVE (1)
- CVE-2024-34515 image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists(). vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-34515 advisory
- https://github.com/spatie/image-optimizer/issues/210 web
- https://github.com/spatie/image-optimizer/pull/211 web
- https://github.com/spatie/image-optimizer/commit/89847b55fbb44b3bcde0283bff8cc5abb5e51b82 web
- https://github.com/spatie/image-optimizer package
- https://github.com/spatie/image-optimizer/compare/1.7.2...1.7.3 web