Vulnerability advisory

CVE-2019-18889

Published Nov 21, 2019Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/symfony/security-http ↗
33c98765dc6fec4907b7431d10e3c0945f061108 through 8b123e7469953fa8e4112a02692dde2b6fdb0a7f	No fix listed
34e089af7d363bd2ded8ad15f06b2b97348b97e5 through a3eddd912d93a8c77ffee2b31448e13864257f4e	No fix listed
13594beb3faaeea891aaae9eeea8ffde16a99faf through a2f67dfe0ecfb713734847f4ada0f4231e28ae71	No fix listed
Also listed as affected (52) `v3.4.35` `v3.4.34` `v3.4.33` `v4.2.11` `v3.4.32` `v3.4.31` `v3.4.30` `v3.4.29` `v4.2.10` `v4.2.9` `v3.4.28` `v4.2.8` `v4.2.7` `v3.4.27` `v3.4.26` `v3.4.25` `v4.2.6` `v4.2.5` `v3.4.24` `v3.4.23` `v4.2.4` `v4.2.3` `v3.4.22` `v4.2.2` `v3.4.21` `v4.2.1` `v3.4.20` `v3.4.19` `v4.2.0-RC1` `v4.2.0-BETA2` `v4.2.0` `v3.4.18` `v3.4.17` `v3.4.16` `v3.4.14` `v3.4.15` `v3.4.13` `v3.4.12` `v3.4.11` `v3.4.10` `v3.4.9` `v3.4.8` `v3.4.7` `v3.4.6` `v3.4.5` `v3.4.4` `v3.4.3` `v3.4.2` `v3.4.1` `v3.4.0-RC2` `v3.4.0-RC1` `v3.4.0`
GIT github.com/symfony/symfony ↗
0a47db379b8cc74cdd84e1e6870fafc4a4ac8351 through c461582064eabe9b93b225be589dd6740620ce0f	No fix listed
7bd9a1bae87e6b2d7eba499ebf3053ff4bc3a483 through 2ba6f17744ee8649ac107039f64d1ee4c959bf32	No fix listed
0bf8d128ef3c492436ab5f1b7c7b130f9e96aad2 through fb4065ac95f08ca26ee605936e537ba2cd4a6bb7	No fix listed
Not specified	`87fb08703e62882a7a6fdb17672070e0ee12dd65`
Also listed as affected (55) `v4.3.7` `v3.4.34` `v4.3.6` `v3.4.33` `v4.3.5` `v3.4.32` `v4.3.4` `v3.4.31` `v4.3.3` `v4.2.11` `v3.4.30` `v4.3.2` `v4.2.10` `v3.4.29` `v4.3.1` `v4.3.0` `v4.2.9` `v3.4.28` `v4.2.8` `v3.4.27` `v4.2.7` `v3.4.26` `v4.2.6` `v3.4.25` `v4.2.5` `v3.4.24` `v4.2.4` `v3.4.23` `v4.2.3` `v3.4.22` `v4.2.2` `v3.4.21` `v4.2.1` `v3.4.20` `v4.2.0` `v3.4.19` `v3.4.18` `v3.4.17` `v3.4.16` `v3.4.15` `v3.4.14` `v3.4.13` `v3.4.12` `v3.4.11` `v3.4.10` `v3.4.9` `v3.4.8` `v3.4.7` `v3.4.6` `v3.4.5` `v3.4.4` `v3.4.3` `v3.4.2` `v3.4.1` `v3.4.0`

Description

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

CVE-2019-18889

Affected versions

Repository

Description

References