Description
PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/phar-stream-wrapper | >= 2.0.0, < 2.1.1 | 2.1.1 | GHSA-3hxw-g85p-qgxm |
| Packagist | typo3/phar-stream-wrapper | >= 3.0.0, < 3.1.1 | 3.1.1 | GHSA-3hxw-g85p-qgxm |
References
- https://typo3.org/security/advisory/typo3-psa-2019-008/
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1
- FEDORA-2019-3c89837025 vendor-advisory
- FEDORA-2019-4d93cf2b34 vendor-advisory
- FEDORA-2019-d5f883429d vendor-advisory