GHSA-r5pm-vrc5-3m73
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | cakephp/queue | >= 0.1.10, < 2.3.1 | 2.3.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
For jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
### Patches
Upgrade to 2.3.1
### Workarounds
You can disable `shouldBeUnique` and handle idempotency in application code.
References
External links from the advisory. They lead to third-party sites.