CVE-2019-18889 Symfony Unsafe Cache Serialization Could Enable RCE
Attackers can achieve remote code execution by exploiting unsafe serialization in the Symfony cache component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-18889?
CVE-2019-18889 is a critical code injection vulnerability in Fedoraproject Fedora, published on 21 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Weakness: CWE-94
Which versions are affected by CVE-2019-18889?
12 open source packages ship an affected version, including symfony/cache and symfony/symfony. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/cache Packagist | From 3.1.0 | 3.4.35 |
symfony/cache Packagist | From 3.1.0 | 3.4.35 |
symfony/cache Packagist | From 4.0.0 | 4.2.12 |
symfony/cache Packagist | From 4.0.0 | 4.2.12 |
symfony/cache Packagist | From 4.3.0 | 4.3.8 |
symfony/cache Packagist | From 4.3.0 | 4.3.8 |
6 more packages
symfony/symfony Packagist | From 3.1.0 | 3.4.35 |
symfony/symfony Packagist | From 3.1.0 | 3.4.35 |
symfony/symfony Packagist | From 4.0.0 | 4.2.12 |
symfony/symfony Packagist | From 4.0.0 | 4.2.12 |
symfony/symfony Packagist | From 4.3.0 | 4.3.8 |
symfony/symfony Packagist | From 4.3.0 | 4.3.8 |
Products include Fedoraproject Fedora, Sensiolabs Symfony.
How do I fix CVE-2019-18889?
Upgrade symfony/cache to a fixed version for your release line: 3.4.35, 4.2.12 or 4.3.8.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-18889 being exploited?
There is no known exploitation of CVE-2019-18889 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2019-18889, GHSA-79gr-58r3-pwm3, UBUNTU-CVE-2019-18889.