CVE-2019-10912
Published: 16 May 2019
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Priority
Status
Package | Release | Status |
---|---|---|
symfony Launchpad, Ubuntu, Debian |
groovy |
Not vulnerable
(3.4.22+dfsg-2)
|
hirsute |
Not vulnerable
(3.4.22+dfsg-2)
|
|
jammy |
Not vulnerable
(3.4.22+dfsg-2)
|
|
kinetic |
Not vulnerable
(3.4.22+dfsg-2)
|
|
lunar |
Not vulnerable
(3.4.22+dfsg-2)
|
|
bionic |
Needed
|
|
cosmic |
Ignored
(end of life)
|
|
disco |
Ignored
(end of life)
|
|
eoan |
Not vulnerable
(3.4.22+dfsg-2)
|
|
focal |
Not vulnerable
(3.4.22+dfsg-2)
|
|
impish |
Not vulnerable
(3.4.22+dfsg-2)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.4.22+dfsg-2)
|
|
xenial |
Not vulnerable
(code not present)
|
|
mantic |
Not vulnerable
(3.4.22+dfsg-2)
|
|
Patches: upstream: https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | Low |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |