Doctrine Security Misconfiguration Vulnerability
The advisory, in context
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.2.7
Fixed in 1.2.7
11 explicitly affected versions
v1.0, v1.1, v1.1.1, v1.1.2, v1.2.0, v1.2.1, v1.2.2, v1.2.3, v1.2.4, v1.2.5, v1.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0",
"v1.1",
"v1.1.1",
"v1.1.2",
"v1.2.0",
"v1.2.1",
"v1.2.2",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6"
]
}From 1.4.0 before 1.4.2
Fixed in 1.4.2
2 explicitly affected versions
v1.4.0, v1.4.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.4.0",
"v1.4.1"
]
}Earlier releases before 2.4.3
Fixed in 2.4.3
24 explicitly affected versions
2.1.3, 2.1.4, 2.2.0, 2.2.0-RC1, 2.2.0-RC3, 2.2.0-RC4, 2.2.0-RC5, 2.2.0BETA1, 2.2.0BETA2, 2.2.1, 2.2.2, 2.2.3, 2.3.0, 2.3.0-BETA1, 2.3.0-RC1, 2.3.0-RC2, 2.3.0-RC3, 2.4.0-RC1, 2.4.0-RC2, 2.4.0-RC3, 2.4.0-RC4, v2.4.0, v2.4.1, v2.4.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.1.3",
"2.1.4",
"2.2.0",
"2.2.0-RC1",
"2.2.0-RC3",
"2.2.0-RC4",
"2.2.0-RC5",
"2.2.0BETA1",
"2.2.0BETA2",
"2.2.1",
"2.2.2",
"2.2.3",
"2.3.0",
"2.3.0-BETA1",
"2.3.0-RC1",
"2.3.0-RC2",
"2.3.0-RC3",
"2.4.0-RC1",
"2.4.0-RC2",
"2.4.0-RC3",
"2.4.0-RC4",
"v2.4.0",
"v2.4.1",
"v2.4.2"
]
}From 2.5.0-stable before 2.5.1
Fixed in 2.5.1
2 explicitly affected versions
v2.5.0, v2.5.0-beta1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.5.0-stable"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.5.0",
"v2.5.0-beta1"
]
}From 2.5.0 before 2.5.1
Fixed in 2.5.1
1 explicitly affected versions
v2.5.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.5.0"
]
}Earlier releases before 1.0.2
Fixed in 1.0.2
12 explicitly affected versions
1.0.0, 1.0.0-BETA10, 1.0.0-BETA11, 1.0.0-BETA12, 1.0.0-BETA13, 1.0.0-BETA4, 1.0.0-BETA5, 1.0.0-BETA6, 1.0.0-BETA7, 1.0.0-BETA8, 1.0.0-BETA9, 1.0.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0",
"1.0.0-BETA10",
"1.0.0-BETA11",
"1.0.0-BETA12",
"1.0.0-BETA13",
"1.0.0-BETA4",
"1.0.0-BETA5",
"1.0.0-BETA6",
"1.0.0-BETA7",
"1.0.0-BETA8",
"1.0.0-BETA9",
"1.0.1"
]
}Earlier releases before 3.0.1
Fixed in 3.0.1
11 explicitly affected versions
v2.0.1, v2.1.0, v2.2.0, v2.2.1, v3.0.0, v3.0.0-BETA1, v3.0.0-BETA2, v3.0.0-BETA3, v3.0.0-BETA4, v3.0.0-BETA5, v3.0.0-BETA6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.0.1",
"v2.1.0",
"v2.2.0",
"v2.2.1",
"v3.0.0",
"v3.0.0-BETA1",
"v3.0.0-BETA2",
"v3.0.0-BETA3",
"v3.0.0-BETA4",
"v3.0.0-BETA5",
"v3.0.0-BETA6"
]
}From 1.12.0 before 1.12.16
Fixed in 1.12.16
16 explicitly affected versions
1.12.0, 1.12.1, 1.12.10, 1.12.11, 1.12.12, 1.12.13, 1.12.14, 1.12.15, 1.12.2, 1.12.3, 1.12.4, 1.12.5, 1.12.6, 1.12.7, 1.12.8, 1.12.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.16"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.12.0",
"1.12.1",
"1.12.10",
"1.12.11",
"1.12.12",
"1.12.13",
"1.12.14",
"1.12.15",
"1.12.2",
"1.12.3",
"1.12.4",
"1.12.5",
"1.12.6",
"1.12.7",
"1.12.8",
"1.12.9"
]
}From 2.5.0 before 2.5.3
Fixed in 2.5.3
3 explicitly affected versions
2.5.0, 2.5.1, 2.5.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0",
"2.5.1",
"2.5.2"
]
}From 3.0.0 before 3.2.1
Fixed in 3.2.1
10 explicitly affected versions
3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.1.0, 3.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.1.0",
"3.2.0"
]
}From 1.0.0 before 1.3.2
Fixed in 1.3.2
4 explicitly affected versions
v1.1, v1.2.0, v1.3.0, v1.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.1",
"v1.2.0",
"v1.3.0",
"v1.3.1"
]
}From 2.4.0 before 2.4.8
Fixed in 2.4.8
8 explicitly affected versions
2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.0",
"2.4.1",
"2.4.2",
"2.4.3",
"2.4.4",
"2.4.5",
"2.4.6",
"2.4.7"
]
}From 2.4.0 before 2.4.8
Fixed in 2.4.8
8 explicitly affected versions
2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.4.0",
"2.4.1",
"2.4.2",
"2.4.3",
"2.4.4",
"2.4.5",
"2.4.6",
"2.4.7"
]
}From 1.0.0 before 1.0.3
Fixed in 1.0.3
3 explicitly affected versions
1.0.0, 1.0.1, 1.0.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0",
"1.0.1",
"1.0.2"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2015-5723
- https://framework.zend.com/security/advisory/ZF2015-07
- https://github.com/FriendsOfPHP/security-advisories/blob/master/aws/aws-sdk-php/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/cache/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-cache/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2015-5723.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/zfcampus/zf-apigility-doctrine/CVE-2015-5723.yaml
- https://github.com/aws/aws-sdk-php/releases/tag/3.2.1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IUUC7HPN4XE5NNTG4MR76OC662XRZUO
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPS7A54FQ2CR6PH4NDR6UIYJIRNFXW67
- https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html
- http://framework.zend.com/security/advisory/ZF2015-07
- http://www.debian.org/security/2015/dsa-3369
- http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html