PT-2019-5182 · Symfony · Symfony

Nicolas-Grekas · Published 2019-11-18 · Updated 2020-08-24 · CVE-2019-18889

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7

Description The issue exists due to the failure to neutralize special elements, which can allow a remote attacker to inject arbitrary code. This is related to the serialization of certain cache adapter interfaces in Symfony, potentially resulting in remote code injection.

Recommendations For Symfony versions 3.4.0 through 3.4.34, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.2.0 through 4.2.11, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.3.0 through 4.3.7, update to a version that fixes the issue with serializing cache adapter interfaces.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

BDU:2020-01855

CVE-2019-18889

DSA-4573-1

GHSA-79GR-58R3-PWM3

Affected Products

Symfony

References · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml · Exploit
• https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18889 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18889 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01855 · Security Note
• https://osv.dev/vulnerability/DSA-4573-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18889 · Vendor Advisory
• https://debian.org/security/2019/dsa-4573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18889 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-18889 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-18889 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18889 · Vendor Advisory