CVE-2019-10912
First published: Tue Apr 16 2019(Updated: )
CVE-2019-10912: Prevent destructors with side-effects from being unserialized
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms-core | >=9.0.0<9.5.8 | |
| composer/symfony/cache | >=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.4.0>=3.4.0<3.4.26>=4.0.0<4.1.0>=4.1.0<4.1.12>=4.2.0<4.2.7 | |
| composer/symfony/symfony | >=2.8.0<2.8.50>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.4.0>=3.4.0<3.4.26>=4.0.0<4.1.0>=4.1.0<4.1.12>=4.2.0<4.2.7 | |
| composer/symfony/phpunit-bridge | >=2.8.0<2.8.50>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.4.0>=3.4.0<3.4.26>=4.0.0<4.1.0>=4.1.0<4.1.12>=4.2.0<4.2.7 | |
| composer/typo3/cms | >=9.0.0<9.5.8 | |
| SensioLabs Symfony | >=2.8.0<2.8.50 | |
| SensioLabs Symfony | >=3.4.0<3.4.26 | |
| SensioLabs Symfony | >=4.1.0<4.1.12 | |
| SensioLabs Symfony | >=4.2.0<4.2.7 | |
| debian/symfony | 3.4.22+dfsg-2+deb10u1 3.4.22+dfsg-2+deb10u2 4.4.19+dfsg-2+deb11u3 5.4.23+dfsg-1 5.4.29+dfsg-1 5.4.30+dfsg-1 | |
| composer/typo3/cms | >=9.0.0<9.5.8 | 9.5.8 |
| composer/typo3/cms-core | >=9.0.0<9.5.8 | 9.5.8 |
| composer/symfony/symfony | >=4.2.0<4.2.7 | 4.2.7 |
| composer/symfony/symfony | >=4.0.0<4.1.12 | 4.1.12 |
| composer/symfony/symfony | >=3.0.0<3.4.26 | 3.4.26 |
| composer/symfony/symfony | >=2.8.0<2.8.50 | 2.8.50 |
| composer/symfony/phpunit-bridge | >=4.2.0<4.2.7 | 4.2.7 |
| composer/symfony/phpunit-bridge | >=4.0.0<4.1.12 | 4.1.12 |
| composer/symfony/phpunit-bridge | >=3.0.0<3.4.26 | 3.4.26 |
| composer/symfony/phpunit-bridge | >=2.8.0<2.8.50 | 2.8.50 |
| composer/symfony/cache | >=4.2.0<4.2.7 | 4.2.7 |
| composer/symfony/cache | >=4.0.0<4.1.12 | 4.1.12 |
| composer/symfony/cache | >=3.1.0<3.4.26 | 3.4.26 |
| >=2.8.0<2.8.50 | ||
| >=3.4.0<3.4.26 | ||
| >=4.1.0<4.1.12 | ||
| >=4.2.0<4.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://typo3.org/security/advisory/typo3-core-sa-2019-016
- https://symfony.com/cve-2019-10912
- https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
- https://seclists.org/bugtraq/2019/May/21
- https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
- https://typo3.org/security/advisory/typo3-core-sa-2019-016/
- https://www.debian.org/security/2019/dsa-4441
- https://security-tracker.debian.org/tracker/CVE-2019-10912
- https://nvd.nist.gov/vuln/detail/CVE-2019-10912
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-10912.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-10912.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
- https://github.com/advisories/GHSA-w2fr-65vp-mxw3 (Advisory)
Frequently Asked Questions
What is CVE-2019-10912?
CVE-2019-10912 is a vulnerability in Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7 that allows caching of objects containing bad user input, leading to potential deletion of files.
What is the severity of CVE-2019-10912?
The severity of CVE-2019-10912 is high with a CVSS score of 7.1.
How can I fix CVE-2019-10912?
To fix CVE-2019-10912, update Symfony to version 2.8.50, 3.4.26, 4.1.12, or 4.2.7.
Where can I find more information about CVE-2019-10912?
More information about CVE-2019-10912 can be found at the TYPO3 security advisory (typo3.org/security/advisory/typo3-core-sa-2019-016) and the Symfony official website (symfony.com/cve-2019-10912 and symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized).
What is the CWE for CVE-2019-10912?
The CWE for CVE-2019-10912 is CWE-502: Deserialization of Untrusted Data.
- collector/friends-of-php
- collector/nvd-index
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-w2fr-65vp-mxw3
- alias/CVE-2019-10912
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- package-manager/composer
- vendor/sensiolabs
- canonical/sensiolabs symfony
- version/sensiolabs symfony/2.8.0
- version/sensiolabs symfony/3.4.0
- version/sensiolabs symfony/4.1.0
- version/sensiolabs symfony/4.2.0
- package-manager/debian