TYPO3 Insecure Deserialization in Query Generator & Query View
The advisory, in context
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module: DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 10.0.0 before 10.2.1
Fixed in 10.2.1
3 explicitly affected versions
v10.0.0, v10.1.0, v10.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v10.0.0",
"v10.1.0",
"v10.2.0"
]
}From 8.0.0 before 8.7.30
Fixed in 8.7.30
23 explicitly affected versions
v8.7.10, v8.7.11, v8.7.12, v8.7.13, v8.7.14, v8.7.15, v8.7.16, v8.7.17, v8.7.18, v8.7.19, v8.7.20, v8.7.21, v8.7.22, v8.7.23, v8.7.24, v8.7.25, v8.7.26, v8.7.27, v8.7.28, v8.7.29, v8.7.7, v8.7.8, v8.7.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.7.30"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.7.10",
"v8.7.11",
"v8.7.12",
"v8.7.13",
"v8.7.14",
"v8.7.15",
"v8.7.16",
"v8.7.17",
"v8.7.18",
"v8.7.19",
"v8.7.20",
"v8.7.21",
"v8.7.22",
"v8.7.23",
"v8.7.24",
"v8.7.25",
"v8.7.26",
"v8.7.27",
"v8.7.28",
"v8.7.29",
"v8.7.7",
"v8.7.8",
"v8.7.9"
]
}From 9.0.0 before 9.5.12
Fixed in 9.5.12
21 explicitly affected versions
v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.10, v9.5.11, v9.5.2, v9.5.3, v9.5.4, v9.5.5, v9.5.6, v9.5.7, v9.5.8, v9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.0.0",
"v9.1.0",
"v9.2.0",
"v9.2.1",
"v9.3.0",
"v9.3.1",
"v9.3.2",
"v9.3.3",
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.10",
"v9.5.11",
"v9.5.2",
"v9.5.3",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7",
"v9.5.8",
"v9.5.9"
]
}From 10.0.0 before 10.2.1
Fixed in 10.2.1
3 explicitly affected versions
v10.0.0, v10.1.0, v10.2.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.2.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v10.0.0",
"v10.1.0",
"v10.2.0"
]
}From 8.0.0 before 8.7.30
Fixed in 8.7.30
45 explicitly affected versions
8.0.0, 8.0.1, 8.1.0, 8.1.1, 8.1.2, 8.2.0, 8.2.1, 8.3.0, 8.3.1, 8.4.0, 8.4.1, 8.5.0, 8.5.1, 8.6.0, 8.6.1, 8.7.0, 8.7.1, 8.7.2, v8.7.10, v8.7.11, v8.7.12, v8.7.13, v8.7.14, v8.7.15, v8.7.16, v8.7.17, v8.7.18, v8.7.19, v8.7.20, v8.7.21, v8.7.22, v8.7.23, v8.7.24, v8.7.25, v8.7.26, v8.7.27, v8.7.28, v8.7.29, v8.7.3, v8.7.4, v8.7.5, v8.7.6, v8.7.7, v8.7.8, v8.7.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.7.30"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.0.0",
"8.0.1",
"8.1.0",
"8.1.1",
"8.1.2",
"8.2.0",
"8.2.1",
"8.3.0",
"8.3.1",
"8.4.0",
"8.4.1",
"8.5.0",
"8.5.1",
"8.6.0",
"8.6.1",
"8.7.0",
"8.7.1",
"8.7.2",
"v8.7.10",
"v8.7.11",
"v8.7.12",
"v8.7.13",
"v8.7.14",
"v8.7.15",
"v8.7.16",
"v8.7.17",
"v8.7.18",
"v8.7.19",
"v8.7.20",
"v8.7.21",
"v8.7.22",
"v8.7.23",
"v8.7.24",
"v8.7.25",
"v8.7.26",
"v8.7.27",
"v8.7.28",
"v8.7.29",
"v8.7.3",
"v8.7.4",
"v8.7.5",
"v8.7.6",
"v8.7.7",
"v8.7.8",
"v8.7.9"
]
}From 9.0.0 before 9.5.12
Fixed in 9.5.12
21 explicitly affected versions
v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.10, v9.5.11, v9.5.2, v9.5.3, v9.5.4, v9.5.5, v9.5.6, v9.5.7, v9.5.8, v9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.0.0",
"v9.1.0",
"v9.2.0",
"v9.2.1",
"v9.3.0",
"v9.3.1",
"v9.3.2",
"v9.3.3",
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.10",
"v9.5.11",
"v9.5.2",
"v9.5.3",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7",
"v9.5.8",
"v9.5.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2019-19849
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-19849.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-19849.yaml
- https://review.typo3.org/q/%2522Resolves:+%252389005%2522+topic:security
- https://typo3.org/security/advisory/typo3-core-sa-2019-026