~ / search / GHSA-w2fr-65vp-mxw3

GHSA-w2fr-65vp-mxw3

Deserialization of untrusted data in Symfony

Source: GitHub Advisory Database (reviewed) High CVE-2019-10912

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/cache >= 3.1.0, < 3.4.26 3.4.26
Packagist symfony/cache >= 4.0.0, < 4.1.12 4.1.12
Packagist symfony/cache >= 4.2.0, < 4.2.7 4.2.7
Packagist symfony/phpunit-bridge >= 2.8.0, < 2.8.50 2.8.50
Packagist symfony/phpunit-bridge >= 3.0.0, < 3.4.26 3.4.26
Packagist symfony/phpunit-bridge >= 4.0.0, < 4.1.12 4.1.12
Packagist symfony/phpunit-bridge >= 4.2.0, < 4.2.7 4.2.7
Packagist symfony/symfony >= 2.8.0, < 2.8.50 2.8.50
Packagist symfony/symfony >= 3.0.0, < 3.4.26 3.4.26
Packagist symfony/symfony >= 4.0.0, < 4.1.12 4.1.12
Packagist symfony/symfony >= 4.2.0, < 4.2.7 4.2.7
Packagist typo3/cms-core >= 9.0.0, < 9.5.8 9.5.8
Packagist typo3/cms >= 9.0.0, < 9.5.8 9.5.8

Details

As written in the advisory (Markdown source, shown as plain text).

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

References

External links from the advisory. They lead to third-party sites.