Deserialization of untrusted data in Symfony
The advisory, in context
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.1.0 before 3.4.26
Fixed in 3.4.26
82 explicitly affected versions
v3.1.0, v3.1.1, v3.1.10, v3.1.2, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-BETA1, v3.2.0-RC1, v3.2.0-RC2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-BETA1, v3.3.0-RC1, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-BETA1, v3.4.0-BETA2, v3.4.0-BETA3, v3.4.0-BETA4, v3.4.0-RC1, v3.4.0-RC2, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.19, v3.4.2, v3.4.20, v3.4.21, v3.4.22, v3.4.23, v3.4.24, v3.4.25, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.4.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.1.0",
"v3.1.1",
"v3.1.10",
"v3.1.2",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-RC2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-BETA1",
"v3.3.0-RC1",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-BETA1",
"v3.4.0-BETA2",
"v3.4.0-BETA3",
"v3.4.0-BETA4",
"v3.4.0-RC1",
"v3.4.0-RC2",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.19",
"v3.4.2",
"v3.4.20",
"v3.4.21",
"v3.4.22",
"v3.4.23",
"v3.4.24",
"v3.4.25",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.0.0 before 4.1.12
Fixed in 4.1.12
31 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-BETA1, v4.1.0-BETA2, v4.1.0-BETA3, v4.1.1, v4.1.10, v4.1.11, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-BETA1",
"v4.1.0-BETA2",
"v4.1.0-BETA3",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9"
]
}From 4.2.0 before 4.2.7
Fixed in 4.2.7
7 explicitly affected versions
v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6"
]
}From 2.8.0 before 2.8.50
Fixed in 2.8.50
50 explicitly affected versions
v2.8.0, v2.8.1, v2.8.10, v2.8.11, v2.8.12, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.17, v2.8.18, v2.8.19, v2.8.2, v2.8.20, v2.8.21, v2.8.22, v2.8.23, v2.8.24, v2.8.25, v2.8.26, v2.8.27, v2.8.28, v2.8.29, v2.8.3, v2.8.30, v2.8.31, v2.8.32, v2.8.33, v2.8.34, v2.8.35, v2.8.36, v2.8.37, v2.8.38, v2.8.39, v2.8.4, v2.8.40, v2.8.41, v2.8.42, v2.8.43, v2.8.44, v2.8.45, v2.8.46, v2.8.47, v2.8.48, v2.8.49, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.8.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.8.0",
"v2.8.1",
"v2.8.10",
"v2.8.11",
"v2.8.12",
"v2.8.13",
"v2.8.14",
"v2.8.15",
"v2.8.16",
"v2.8.17",
"v2.8.18",
"v2.8.19",
"v2.8.2",
"v2.8.20",
"v2.8.21",
"v2.8.22",
"v2.8.23",
"v2.8.24",
"v2.8.25",
"v2.8.26",
"v2.8.27",
"v2.8.28",
"v2.8.29",
"v2.8.3",
"v2.8.30",
"v2.8.31",
"v2.8.32",
"v2.8.33",
"v2.8.34",
"v2.8.35",
"v2.8.36",
"v2.8.37",
"v2.8.38",
"v2.8.39",
"v2.8.4",
"v2.8.40",
"v2.8.41",
"v2.8.42",
"v2.8.43",
"v2.8.44",
"v2.8.45",
"v2.8.46",
"v2.8.47",
"v2.8.48",
"v2.8.49",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.8.9"
]
}From 3.0.0 before 3.4.26
Fixed in 3.4.26
94 explicitly affected versions
v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.0-BETA1, v3.1.0-RC1, v3.1.1, v3.1.10, v3.1.2, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-BETA1, v3.2.0-RC1, v3.2.0-RC2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-BETA1, v3.3.0-RC1, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-BETA1, v3.4.0-BETA2, v3.4.0-BETA3, v3.4.0-BETA4, v3.4.0-RC1, v3.4.0-RC2, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.19, v3.4.2, v3.4.20, v3.4.21, v3.4.22, v3.4.23, v3.4.24, v3.4.25, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.0-BETA1",
"v3.1.0-RC1",
"v3.1.1",
"v3.1.10",
"v3.1.2",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-RC2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-BETA1",
"v3.3.0-RC1",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-BETA1",
"v3.4.0-BETA2",
"v3.4.0-BETA3",
"v3.4.0-BETA4",
"v3.4.0-RC1",
"v3.4.0-RC2",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.19",
"v3.4.2",
"v3.4.20",
"v3.4.21",
"v3.4.22",
"v3.4.23",
"v3.4.24",
"v3.4.25",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.0.0 before 4.1.12
Fixed in 4.1.12
31 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-BETA1, v4.1.0-BETA2, v4.1.0-BETA3, v4.1.1, v4.1.10, v4.1.11, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-BETA1",
"v4.1.0-BETA2",
"v4.1.0-BETA3",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9"
]
}From 4.2.0 before 4.2.7
Fixed in 4.2.7
7 explicitly affected versions
v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6"
]
}From 2.8.0 before 2.8.50
Fixed in 2.8.50
50 explicitly affected versions
v2.8.0, v2.8.1, v2.8.10, v2.8.11, v2.8.12, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.17, v2.8.18, v2.8.19, v2.8.2, v2.8.20, v2.8.21, v2.8.22, v2.8.23, v2.8.24, v2.8.25, v2.8.26, v2.8.27, v2.8.28, v2.8.29, v2.8.3, v2.8.30, v2.8.31, v2.8.32, v2.8.33, v2.8.34, v2.8.35, v2.8.36, v2.8.37, v2.8.38, v2.8.39, v2.8.4, v2.8.40, v2.8.41, v2.8.42, v2.8.43, v2.8.44, v2.8.45, v2.8.46, v2.8.47, v2.8.48, v2.8.49, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.8.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.8.0",
"v2.8.1",
"v2.8.10",
"v2.8.11",
"v2.8.12",
"v2.8.13",
"v2.8.14",
"v2.8.15",
"v2.8.16",
"v2.8.17",
"v2.8.18",
"v2.8.19",
"v2.8.2",
"v2.8.20",
"v2.8.21",
"v2.8.22",
"v2.8.23",
"v2.8.24",
"v2.8.25",
"v2.8.26",
"v2.8.27",
"v2.8.28",
"v2.8.29",
"v2.8.3",
"v2.8.30",
"v2.8.31",
"v2.8.32",
"v2.8.33",
"v2.8.34",
"v2.8.35",
"v2.8.36",
"v2.8.37",
"v2.8.38",
"v2.8.39",
"v2.8.4",
"v2.8.40",
"v2.8.41",
"v2.8.42",
"v2.8.43",
"v2.8.44",
"v2.8.45",
"v2.8.46",
"v2.8.47",
"v2.8.48",
"v2.8.49",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.8.9"
]
}From 3.0.0 before 3.4.26
Fixed in 3.4.26
94 explicitly affected versions
v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.0-BETA1, v3.1.0-RC1, v3.1.1, v3.1.10, v3.1.2, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-BETA1, v3.2.0-RC1, v3.2.0-RC2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-BETA1, v3.3.0-RC1, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-BETA1, v3.4.0-BETA2, v3.4.0-BETA3, v3.4.0-BETA4, v3.4.0-RC1, v3.4.0-RC2, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.19, v3.4.2, v3.4.20, v3.4.21, v3.4.22, v3.4.23, v3.4.24, v3.4.25, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.0-BETA1",
"v3.1.0-RC1",
"v3.1.1",
"v3.1.10",
"v3.1.2",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-RC2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-BETA1",
"v3.3.0-RC1",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-BETA1",
"v3.4.0-BETA2",
"v3.4.0-BETA3",
"v3.4.0-BETA4",
"v3.4.0-RC1",
"v3.4.0-RC2",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.19",
"v3.4.2",
"v3.4.20",
"v3.4.21",
"v3.4.22",
"v3.4.23",
"v3.4.24",
"v3.4.25",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.0.0 before 4.1.12
Fixed in 4.1.12
31 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-BETA1, v4.1.0-BETA2, v4.1.0-BETA3, v4.1.1, v4.1.10, v4.1.11, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-BETA1",
"v4.1.0-BETA2",
"v4.1.0-BETA3",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9"
]
}From 4.2.0 before 4.2.7
Fixed in 4.2.7
7 explicitly affected versions
v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6"
]
}From 9.0.0 before 9.5.8
Fixed in 9.5.8
17 explicitly affected versions
v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.2, v9.5.3, v9.5.4, v9.5.5, v9.5.6, v9.5.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.0.0",
"v9.1.0",
"v9.2.0",
"v9.2.1",
"v9.3.0",
"v9.3.1",
"v9.3.2",
"v9.3.3",
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.2",
"v9.5.3",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7"
]
}From 9.0.0 before 9.5.8
Fixed in 9.5.8
17 explicitly affected versions
v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.2, v9.5.3, v9.5.4, v9.5.5, v9.5.6, v9.5.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.0.0",
"v9.1.0",
"v9.2.0",
"v9.2.1",
"v9.3.0",
"v9.3.1",
"v9.3.2",
"v9.3.3",
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.2",
"v9.5.3",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10912
- https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
- https://www.debian.org/security/2019/dsa-4441
- https://typo3.org/security/advisory/typo3-core-sa-2019-016
- https://symfony.com/cve-2019-10912
- https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
- https://seclists.org/bugtraq/2019/May/21
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml