GitHub Advisoryadvisory · Packagist
GHSA-r7cj-8hjg-x622 DBAL 3 SQL Injection Security Vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2021-43608
- Ecosystem
- Packagist
- Packages
- doctrine/dbal
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
- Reviewed
- 2021-11-15
Affected packages
• Packagist doctrine/dbal: >= 3.0.0, < 3.1.4 → fixed in 3.1.4
Description
We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.
We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.
The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`.
As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.
This vulnerability has been assigned CVE-2021-43608.
Related
Alias · CVE (1)
- CVE-2021-43608 Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. vulnerability
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/doctrine/dbal/security/advisories/GHSA-r7cj-8hjg-x622 web
- https://nvd.nist.gov/vuln/detail/CVE-2021-43608 advisory
- https://github.com/doctrine/dbal/commit/9dcfa4cb6c03250b78a84737ba7ceb82f4b7ba4d web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/dbal/CVE-2021-43608.yaml web
- https://github.com/doctrine/dbal web
- https://github.com/doctrine/dbal/releases web
- https://www.doctrine-project.org/2021/11/11/dbal3-vulnerability-fixed.html web