Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Impact
When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.0.0 before 2.0.24Ecosystem versions | 2.0.24 |
| From 2.1.0 before 2.1.12Ecosystem versions | 2.1.12 |
| From 2.2.0 before 2.2.5Ecosystem versions | 2.2.5 |
| From 2.3.0 before 2.3.3Ecosystem versions | 2.3.3 |
Version evidence: OSV · GHSA-q8j7-fjh7-25v5
View original version evidence (38 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 2.0.0 before 2.0.24Ecosystem versions | 2.0.24 |
| From 2.1.0 before 2.1.12Ecosystem versions | 2.1.12 |
| From 2.2.0 before 2.2.5Ecosystem versions | 2.2.5 |
| From 2.3.0 before 2.3.3Ecosystem versions | 2.3.3 |
Version evidence: OSV · GHSA-q8j7-fjh7-25v5
View original version evidence (39 explicit versions)
Original source description
When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).
As a consequence, arrays or traversable objects stored in fields using the @Valid constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2013-4751
- Source reference bugzilla.redhat.com/show_bug.cgi
- Security advisory exchange.xforce.ibmcloud.com/vulnerabilities/86364
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-4751.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/validator/CVE-2013-4751.yaml
- Source reference github.com/symfony/validator
- Security advisory symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released
- Security advisory web.archive.org/web/20200228181137/http://www.securityfocus.com/bid/61709
- Source reference lists.fedoraproject.org/pipermail/package-announce/2013-August/114380.html
- Source reference lists.fedoraproject.org/pipermail/package-announce/2013-August/114436.html
- Security advisory symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released