CVE-2019-9081: Laravel Framework Deserialization Vulnerability

Q: Should this CVE be treated as an active critical vulnerability in Laravel deployments?

No. This candidate was withdrawn by its CNA after further investigation found that it was not a security issue; its status is rejected and it must not be used.

Q: Do affected systems require emergency mitigation or patching for this CVE?

No action is indicated for this rejected CVE. The provided severity and deserialization claims should not be used for vulnerability triage because the candidate was explicitly rejected.

Published Feb 24, 2019

Updated

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Other sources

Laravel Framework Deserialization Vulnerability

— Packagist

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

— NVD

The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the PendingCommand class in PendingCommand.php.

Affected Software

2 affected componentsFixes available

composer/laravel/framework>=5.7.0<6.20.44

6.20.44

composer/laravel/framework>=5.7.0, <6.20.44

6.20.44

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/laravel/framework to a version that resolves this vulnerability.
Fixed in 6.20.44

Event History

Feb 24, 2019

CVE Published

via MITRE·05:00 PM

Rejected

via MITRE·05:00 PM

Data Sourced

via NVD·05:29 PM

Description

May 14, 2022

Advisory Published

01:31 AM

Data Sourced

via GitHub·01:31 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via Packagist·01:31 AM

DescriptionSeverityAffected Software

Aug 19, 2022

Rejected

via MITRE·11:15 PM

Frequently Asked Questions

Should this CVE be treated as an active critical vulnerability in Laravel deployments?

No. This candidate was withdrawn by its CNA after further investigation found that it was not a security issue; its status is rejected and it must not be used.

Do affected systems require emergency mitigation or patching for this CVE?

No action is indicated for this rejected CVE. The provided severity and deserialization claims should not be used for vulnerability triage because the candidate was explicitly rejected.

CVE-2019-9081: Laravel Framework Deserialization Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Should this CVE be treated as an active critical vulnerability in Laravel deployments?

Do affected systems require emergency mitigation or patching for this CVE?

Company

Resources

Contact

Frequently Asked Questions

Should this CVE be treated as an active critical vulnerability in Laravel deployments?

Do affected systems require emergency mitigation or patching for this CVE?