GitHub Advisoryadvisory · Packagist

GHSA-9c24-g32g-35rj Drupal PECL YAML parser unsafe object handling

CRITICAL Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2017-6920
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 8.0, < 8.3.4 → fixed in 8.3.4 • Packagist drupal/drupal: >= 8.0, < 8.3.4 → fixed in 8.3.4

Description

Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects safely during certain operations.

Related

Alias · CVE (1)

  • CVE-2017-6920 Drupal core 8 before versions 8.3.4 allows remote attackers to execute arbitrary code due to the PECL YAML parser not handling PHP objects… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References