CVE-2019-18889

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-18889
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18889.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-18889
Aliases
Downstream
Published
2019-11-21T23:15:13Z
Modified
2026-08-03T11:46:22Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "31"
                },
                {
                    "last_affected": "31"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "fedoraproject:fedora"
        }
    ]
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
33c98765dc6fec4907b7431d10e3c0945f061108
Last Affected
8b123e7469953fa8e4112a02692dde2b6fdb0a7f
Introduced
34e089af7d363bd2ded8ad15f06b2b97348b97e5
Last Affected
a3eddd912d93a8c77ffee2b31448e13864257f4e
Introduced
13594beb3faaeea891aaae9eeea8ffde16a99faf
Last Affected
a2f67dfe0ecfb713734847f4ada0f4231e28ae71
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.4.0"
        },
        {
            "last_affected": "3.4.34"
        },
        {
            "introduced": "4.2.0"
        },
        {
            "last_affected": "4.2.11"
        },
        {
            "introduced": "4.3.0"
        },
        {
            "last_affected": "4.3.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v3.*
v3.4.0
v3.4.0-RC1
v3.4.0-RC2
v3.4.1
v3.4.10
v3.4.11
v3.4.12
v3.4.13
v3.4.14
v3.4.15
v3.4.16
v3.4.17
v3.4.18
v3.4.19
v3.4.2
v3.4.20
v3.4.21
v3.4.22
v3.4.23
v3.4.24
v3.4.25
v3.4.26
v3.4.27
v3.4.28
v3.4.29
v3.4.3
v3.4.30
v3.4.31
v3.4.32
v3.4.33
v3.4.34
v3.4.35
v3.4.4
v3.4.5
v3.4.6
v3.4.7
v3.4.8
v3.4.9
v4.*
v4.2.0
v4.2.0-BETA2
v4.2.0-RC1
v4.2.1
v4.2.10
v4.2.11
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.2.7
v4.2.8
v4.2.9
v4.3.0
v4.3.0-RC1
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18889.json"

Git / github.com/symfony/symfony

Affected ranges

Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
87fb08703e62882a7a6fdb17672070e0ee12dd65
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0-BETA1
v2.3.0-BETA2
v2.4.0-BETA1
v2.4.0-BETA2
v2.5.0-BETA1
v2.5.0-BETA2
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.2.0-BETA1
v3.2.0-RC1
v3.3.0-BETA1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.2.0-BETA1
v4.2.0-BETA2
v4.3.0
v4.3.0-BETA1
v4.3.0-BETA2
v4.3.0-RC1
v4.3.1
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18889.json"