GHSA-pgwj-prpq-jpc2
Symfony Service IDs Allow Injection
At a glance
- Published
- Updated
- CVE
- CVE-2019-10910
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Affected packages
| Package | Versions |
|---|---|
| Packagist · symfony/dependency-injection | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/dependency-injection | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/dependency-injection | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/dependency-injection | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/dependency-injection | introduced 4.2.0, fixed 4.2.7 |
| Packagist · symfony/proxy-manager-bridge | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/proxy-manager-bridge | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/proxy-manager-bridge | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/proxy-manager-bridge | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/proxy-manager-bridge | introduced 4.2.0, fixed 4.2.7 |
| Packagist · symfony/symfony | introduced 2.7.0, fixed 2.7.51 |
| Packagist · symfony/symfony | introduced 2.8.0, fixed 2.8.50 |
| Packagist · symfony/symfony | introduced 3.0.0, fixed 3.4.26 |
| Packagist · symfony/symfony | introduced 4.0.0, fixed 4.1.12 |
| Packagist · symfony/symfony | introduced 4.2.0, fixed 4.2.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10910 ADVISORY
- https://github.com/symfony/symfony/commit/3876c75f858d5d82e2c309698d21af2f1d721afb WEB
- https://github.com/symfony/symfony/commit/4c80c3444854ef384df94deb4acbcef4b5e5243b WEB
- https://github.com/symfony/symfony/commit/d2fb5893923292a1da7985f0b56960b5bb10737b WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/dependency-injection/CVE-2019-10910.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/proxy-manager-bridge/CVE-2019-10910.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10910.yaml WEB
- https://github.com/symfony/symfony PACKAGE
- https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid WEB
- https://symfony.com/cve-2019-10910 WEB
- https://www.synology.com/security/advisory/Synology_SA_19_19 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |