GHSA-r5pm-vrc5-3m73low3.7
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
The advisory, in context
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches
Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
cakephp/queue Packagist
Ecosystem versions
From 0.1.10 before 2.3.1
Fixed in 2.3.1
12 explicitly affected versions
0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 1.0.0, 1.1.0, 2.0.1, 2.1.0, 2.2.0, 2.3.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0.1.10"
},
{
"fixed": "2.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.10",
"0.1.11",
"0.1.12",
"0.1.13",
"0.1.14",
"0.1.15",
"1.0.0",
"1.1.0",
"2.0.1",
"2.1.0",
"2.2.0",
"2.3.0"
]
}