Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/symfony/security-http ↗ | |
| a8d5dd00894f8b5e3edb897f4504c51ddc442370 to before 7e0b49a8d10e31c0cd0431bbc99b20b6c5be4fb7 | 7e0b49a8d10e31c0cd0431bbc99b20b6c5be4fb7 |
| 33c98765dc6fec4907b7431d10e3c0945f061108 to before 58e2b17e90640c3bc80dcf0601561c6b54e4869f | 58e2b17e90640c3bc80dcf0601561c6b54e4869f |
| 946668ddc1fa0279fe03e2c090ebc29881f12ddb to before 67f6163f2efe91e586b5a6982294c6e91c70e335 | 67f6163f2efe91e586b5a6982294c6e91c70e335 |
| 34e089af7d363bd2ded8ad15f06b2b97348b97e5 to before ff2189e9921e4a88c4f621fa44444fe2b4fb1b11 | ff2189e9921e4a88c4f621fa44444fe2b4fb1b11 |
Also listed as affected (100)
| |
| GIT github.com/symfony/symfony ↗ | |
| 5615b92cd452cd54f1433a3f53de87c096a1107f to before 2ef4e09343bdbdee0a7968f58b8ec594ce0aa47d | 2ef4e09343bdbdee0a7968f58b8ec594ce0aa47d |
| 0a47db379b8cc74cdd84e1e6870fafc4a4ac8351 to before 1b89e7baec9891c323bbf1ec81af77d901fc60c9 | 1b89e7baec9891c323bbf1ec81af77d901fc60c9 |
| 58261043876feb695640457c5675bb331a6eb3b7 to before 482d06316077da115e5dac2afd2a7ce9f5f100f7 | 482d06316077da115e5dac2afd2a7ce9f5f100f7 |
| 7bd9a1bae87e6b2d7eba499ebf3053ff4bc3a483 to before 6122c791d640b75702514c18c8aae816dbbefae2 | 6122c791d640b75702514c18c8aae816dbbefae2 |
| Not specified | 4fb975281634b8d49ebf013af9e502e67c28816b |
Also listed as affected (95)
| |
Description
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
References
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/ ↗
- Weblists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/ ↗
- Webseclists.org/bugtraq/2019/May/21 ↗
- Advisorysymfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized ↗
- Advisorytypo3.org/security/advisory/typo3-core-sa-2019-016/ ↗
- Advisorywww.debian.org/security/2019/dsa-4441 ↗
- Fixgithub.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b ↗