PT-2019-5880 · Phpfastcache · Phpfastcache

Geolim4 · Published 2019-12-12 · Updated 2020-10-07 · CVE-2019-16774

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpfastcache versions prior to 5.1.3

Description The issue is related to shortcomings in the deserialization mechanism of the PhpFastCache library. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with a possible object injection in the cookie driver.

Recommendations For versions prior to 5.1.3, consider using another driver, such as the "Files" (Filesystem) driver, as a temporary workaround until the issue is resolved. Update to version 5.1.3 or later, which enforces JSON conversion when deserializing to address the issue.

Fix

Deserialization of Untrusted Data

Code Injection

Weakness Enumeration

CWE-502

CWE-94

Related Identifiers

BDU:2021-03584

CVE-2019-16774

GHSA-484F-743F-6JX2

Affected Products

Phpfastcache

References · 11

• https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-16774 · Security Note
• https://osv.dev/vulnerability/GHSA-484f-743f-6jx2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-16774 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03584 · Security Note
• https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2 · Note
• https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13 · Note
• https://github.com/PHPSocialNetwork/phpfastcache · Note
• https://vuldb.com/?id.147087 · Note
• https://github.com/advisories/GHSA-484f-743f-6jx2 · Note
• https://cxsecurity.com/cveshow/CVE-2019-16774 · Note