GitHub Advisoryadvisory · Packagist

GHSA-79gr-58r3-pwm3 Symfony Unsafe Cache Serialization Could Enable RCE

CRITICAL Published 2019-12-02 Modified 2024-02-01 Official page ↗
Aliases
CVE-2019-18889
Ecosystem
Packagist
Packages
symfony/cache, symfony/symfony
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2019-12-01

Affected packages

• Packagist symfony/cache: >= 3.1.0, < 3.4.35 → fixed in 3.4.35 • Packagist symfony/cache: >= 4.0.0, < 4.2.12 → fixed in 4.2.12 • Packagist symfony/cache: >= 4.3.0, < 4.3.8 → fixed in 4.3.8 • Packagist symfony/symfony: >= 3.1.0, < 3.4.35 → fixed in 3.4.35 • Packagist symfony/symfony: >= 4.0.0, < 4.2.12 → fixed in 4.2.12 • Packagist symfony/symfony: >= 4.3.0, < 4.3.8 → fixed in 4.3.8

Description

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

Related

Alias · CVE (1)

  • CVE-2019-18889 An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References