PT-2019-5182 · Symfony · Symfony

Nicolas-Grekas · Publicado 2019-11-18 · Atualizado 2020-08-24 · CVE-2019-18889

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7

Description The issue exists due to the failure to neutralize special elements, which can allow a remote attacker to inject arbitrary code. This is related to the serialization of certain cache adapter interfaces in Symfony, potentially resulting in remote code injection.

Recommendations For Symfony versions 3.4.0 through 3.4.34, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.2.0 through 4.2.11, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.3.0 through 4.3.7, update to a version that fixes the issue with serializing cache adapter interfaces.

Exploit

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

BDU:2020-01855

CVE-2019-18889

DSA-4573-1

GHSA-79GR-58R3-PWM3

Produtos afetados

Symfony

Referências · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml · Exploit
• https://github.com/symfony/symfony/releases/tag/v4.3.8 · Nota
• https://github.com/symfony/symfony/commit/8817d28fcaacb31fe01d267f6e19b44d8179395a · Nota
• https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances · Aviso do Fabricante
• https://symfony.com/blog/symfony-4-3-8-released · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-18889 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18889 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-01855 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4573-1 · Aviso do Fabricante
• https://symfony.com/cve-2019-18889 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-18889 · Aviso do Fabricante
• https://debian.org/security/2019/dsa-4573 · Aviso do Fabricante