GHSA-r5pm-vrc5-3m73: Low severity composer/cakephp/queue vulnerability
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/queueto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.3.1 - Configuration
Disable shouldBeUnique and handle idempotency in application code.
queue plugin shouldBeUnique = false
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the queue plugin are affected when jobs have shouldBeUnique set to true and user-controlled data is included in the job parameters.
What does an attacker need to do to exploit it?
An attacker must be able to supply data used in parameters of a unique job. They can then craft values that collide with a legitimate job's generated unique identifier, causing the legitimate job to be dropped.
Is there a workaround if upgrading is not immediately possible?
Disable shouldBeUnique and implement idempotency handling in the application code instead.
What version contains the fix?
Upgrade the cakephp/queue Composer package to version 2.3.1.