~ / search / GHSA-xhh6-956q-4q69

GHSA-xhh6-956q-4q69

Argument injection in a MimeTypeGuesser in Symfony

Source: GitHub Advisory Database (reviewed) High CVE-2019-18888

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/http-foundation >= 2.0.0, < 2.8.52 2.8.52
Packagist symfony/http-foundation >= 3.0.0, < 3.4.35 3.4.35
Packagist symfony/http-foundation >= 4.0.0, < 4.2.12 4.2.12
Packagist symfony/http-foundation >= 4.3.0, < 4.3.8 4.3.8
Packagist symfony/mime >= 4.3.0, < 4.3.8 4.3.8
Packagist symfony/symfony >= 2.0.0, < 2.8.52 2.8.52
Packagist symfony/symfony >= 3.0.0, < 3.4.35 3.4.35
Packagist symfony/symfony >= 4.0.0, < 4.2.12 4.2.12
Packagist symfony/symfony >= 4.3.0, < 4.3.8 4.3.8

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).

References

External links from the advisory. They lead to third-party sites.