Lack of data validation In cakephp/queue
Description
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches
Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 packagist | 2.3.1 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.