FLAT-R9VBH – Vulnerability | Fluid Attacks Database

Database

Description

Deserialization of untrusted data in Symfony In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	typo3/cms-core	>=9.0.0 <9.5.8	9.5.8
packagist	symfony/cache	>=3.1.0 <3.4.26 \|\| >=4.0.0 <4.1.12 \|\| >=4.2.0 <4.2.7	3.4.26, 4.1.12, 4.2.7
packagist	symfony/phpunit-bridge	>=2.8.0 <2.8.50 \|\| >=3.0.0 <3.4.26 \|\| >=4.0.0 <4.1.12 \|\| >=4.2.0 <4.2.7	2.8.50, 3.4.26, 4.1.12, 4.2.7
packagist	symfony/symfony	>=2.8.0 <2.8.50 \|\| >=3.0.0 <3.4.26 \|\| >=4.0.0 <4.1.12 \|\| >=4.2.0 <4.2.7	2.8.50, 3.4.26, 4.1.12, 4.2.7
debian 11	symfony	>=0 <3.4.22+dfsg-2	3.4.22+dfsg-2
packagist	typo3/cms	>=9.0.0 <9.5.8	9.5.8
debian 13	symfony	>=0 <3.4.22+dfsg-2	3.4.22+dfsg-2
debian 12	symfony	>=0 <3.4.22+dfsg-2	3.4.22+dfsg-2
debian 14	symfony	>=0 <3.4.22+dfsg-2	3.4.22+dfsg-2

Aliases

1. CVE-2019-109122. NVD-2019-109123. OSV-2019-109124. OSV-DEBIAN-2019-109125. GCVE-2019-109126. SECURITY-TRACKER-CVE-2019-10912

References

1. https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b2. https://www.debian.org/security/2019/dsa-44413. https://typo3.org/security/advisory/typo3-core-sa-2019-0164. https://symfony.com/cve-2019-109125. https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized6. https://seclists.org/bugtraq/2019/May/217. https://lists.fedoraproject.org/archives/list/[email protected]/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD8. https://lists.fedoraproject.org/archives/list/[email protected]/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL9. https://lists.fedoraproject.org/archives/list/[email protected]/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA10. https://lists.fedoraproject.org/archives/list/[email protected]/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD11. https://lists.fedoraproject.org/archives/list/[email protected]/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU12. https://lists.fedoraproject.org/archives/list/[email protected]/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO13. https://lists.fedoraproject.org/archives/list/[email protected]/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O14. https://lists.fedoraproject.org/archives/list/[email protected]/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL17. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA18. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD19. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU20. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO21. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O22. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD23. https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-10912.yaml24. https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-10912.yaml25. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml26. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml27. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml