PT-2019-12515 · Php · Pharstreamwrapper

Tom Klingenberg · Publicado 2019-05-09 · Atualizado 2022-05-24 · CVE-2019-11830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PharStreamWrapper package versions 2.x before 2.1.1 PharStreamWrapper package versions 3.x before 3.1.1

Description The PharMetaDataInterceptor in the PharStreamWrapper package mishandles Phar stub parsing, allowing attackers to bypass a deserialization protection mechanism.

Recommendations For PharStreamWrapper package versions 2.x before 2.1.1, update to version 2.1.1 or later. For PharStreamWrapper package versions 3.x before 3.1.1, update to version 3.1.1 or later.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-11830

GHSA-3HXW-G85P-QGXM

Produtos afetados

Pharstreamwrapper

Referências · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/phar-stream-wrapper/CVE-2019-11830.yaml · Exploit
• https://github.com/TYPO3/phar-stream-wrapper · Nota
• https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1 · Nota
• https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3hxw-g85p-qgxm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11830 · Nota de Segurança
• https://typo3.org/security/advisory/typo3-psa-2019-008 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-11830 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523 · Aviso do Fabricante