Skip to content
OpenAdvisories
Critical · 9.8 CVE-2019-10910 EUVD-2019-0759GHSA-pgwj-prpq-jpc2

Symfony Service IDs Allow Injection

Published May 16, 2019 · Updated Aug 4, 2024 · Assigned by mitre

Package: symfony Package: symfony Package: symfony/dependency-injection Package: symfony/proxy-manager-bridge Package: symfony/symfony Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 symfony 3.4.22+dfsg-2 —
Debian 13 symfony 3.4.22+dfsg-2 —
Debian 12 symfony 3.4.22+dfsg-2 —
Debian 9 symfony 2.8.7+dfsg-1.3+deb9u2 DSA-4441-1
Debian 8 symfony 2.3.21+dfsg-4+deb8u5 DLA-1778-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS symfony No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS symfony No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist symfony/dependency-injection >= 2.7.0, < 2.7.51 2.7.51 GHSA-pgwj-prpq-jpc2
Packagist symfony/dependency-injection >= 2.8.0, < 2.8.50 2.8.50 GHSA-pgwj-prpq-jpc2
Packagist symfony/dependency-injection >= 3.0.0, < 3.4.26 3.4.26 GHSA-pgwj-prpq-jpc2
Packagist symfony/dependency-injection >= 4.0.0, < 4.1.12 4.1.12 GHSA-pgwj-prpq-jpc2
Packagist symfony/dependency-injection >= 4.2.0, < 4.2.7 4.2.7 GHSA-pgwj-prpq-jpc2
Packagist symfony/proxy-manager-bridge >= 2.7.0, < 2.7.51 2.7.51 GHSA-pgwj-prpq-jpc2
Packagist symfony/proxy-manager-bridge >= 2.8.0, < 2.8.50 2.8.50 GHSA-pgwj-prpq-jpc2
Packagist symfony/proxy-manager-bridge >= 3.0.0, < 3.4.26 3.4.26 GHSA-pgwj-prpq-jpc2
Packagist symfony/proxy-manager-bridge >= 4.0.0, < 4.1.12 4.1.12 GHSA-pgwj-prpq-jpc2
Packagist symfony/proxy-manager-bridge >= 4.2.0, < 4.2.7 4.2.7 GHSA-pgwj-prpq-jpc2
Packagist symfony/symfony >= 2.7.0, < 2.7.51 2.7.51 GHSA-pgwj-prpq-jpc2
Packagist symfony/symfony >= 2.8.0, < 2.8.50 2.8.50 GHSA-pgwj-prpq-jpc2
Packagist symfony/symfony >= 3.0.0, < 3.4.26 3.4.26 GHSA-pgwj-prpq-jpc2
Packagist symfony/symfony >= 4.0.0, < 4.1.12 4.1.12 GHSA-pgwj-prpq-jpc2
Packagist symfony/symfony >= 4.2.0, < 4.2.7 4.2.7 GHSA-pgwj-prpq-jpc2

Advisories 3

References