CVE-2013-4751: Input Validation
php-symfony2-Validator has loss of information during serialization
Other sources
Validation metadata serialization and loss of information
When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).
As a consequence, arrays or traversable objects stored in fields using the @Valid constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2013-4751?
CVE-2013-4751 is a vulnerability in the Validator component of Symfony that allows for loss of information during serialization.
How does CVE-2013-4751 affect software?
CVE-2013-4751 affects versions 2.0.0 to 2.0.24, 2.1.0 to 2.1.12, 2.2.0 to 2.2.5, and 2.3.0 to 2.3.3 of the Symfony and Validator packages.
What is the severity of CVE-2013-4751?
CVE-2013-4751 has a severity value of 8.1, which is considered high.
How can I fix CVE-2013-4751?
To fix CVE-2013-4751, update to version 2.3.3 for Symfony/Validator, or versions 2.2.5, 2.1.12, or 2.0.24 for Symfony/Validator.
Where can I find more information about CVE-2013-4751?
You can find more information about CVE-2013-4751 on the Symfony blog, NVD, and Bugzilla.