GHSA-xhh6-956q-4q69
Argument injection in a MimeTypeGuesser in Symfony
At a glance
- Published
- Updated
- CVE
- CVE-2019-18888
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Affected packages
| Package | Versions |
|---|---|
| Packagist · symfony/http-foundation | introduced 2.0.0, fixed 2.8.52 |
| Packagist · symfony/http-foundation | introduced 3.0.0, fixed 3.4.35 |
| Packagist · symfony/http-foundation | introduced 4.0.0, fixed 4.2.12 |
| Packagist · symfony/http-foundation | introduced 4.3.0, fixed 4.3.8 |
| Packagist · symfony/mime | introduced 4.3.0, fixed 4.3.8 |
| Packagist · symfony/symfony | introduced 2.0.0, fixed 2.8.52 |
| Packagist · symfony/symfony | introduced 3.0.0, fixed 3.4.35 |
| Packagist · symfony/symfony | introduced 4.0.0, fixed 4.2.12 |
| Packagist · symfony/symfony | introduced 4.3.0, fixed 4.3.8 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-18888 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml WEB
- https://github.com/symfony/symfony/releases/tag/v4.3.8 WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA WEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ WEB
- https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser WEB
- https://symfony.com/blog/symfony-4-3-8-released WEB
- https://symfony.com/cve-2019-18888 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |