GHSA-64vj-933f-6pm3

Suggest an improvement
Source
https://github.com/advisories/GHSA-64vj-933f-6pm3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-64vj-933f-6pm3/GHSA-64vj-933f-6pm3.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-64vj-933f-6pm3
Published
2024-05-15T21:28:27Z
Modified
2024-11-29T05:25:36.514729Z
Summary
eZ Platform Object Injection in SiteAccessMatchListener
Details

This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.

Update: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T21:28:27Z"
}
References

Affected packages

Packagist / ezsystems/ezpublish-kernel

Package

Name
ezsystems/ezpublish-kernel
Purl
pkg:composer/ezsystems/ezpublish-kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
7.5.0
Fixed
7.5.8

Affected versions

v7.*

v7.5.0
v7.5.1
v7.5.2
v7.5.3
v7.5.4
v7.5.5
v7.5.6-rc1
v7.5.6
v7.5.6.2
v7.5.7-rc1
v7.5.7
v7.5.7.1

Packagist / ezsystems/ezpublish-kernel

Package

Name
ezsystems/ezpublish-kernel
Purl
pkg:composer/ezsystems/ezpublish-kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.13.6.4

Affected versions

v6.*

v6.13.0
v6.13.0.1
v6.13.1-rc1
v6.13.1
v6.13.1.1
v6.13.1.2
v6.13.2-beta1
v6.13.2-rc1
v6.13.2
v6.13.3-beta1
v6.13.3-rc1
v6.13.3
v6.13.4-beta1
v6.13.4-rc1
v6.13.4
v6.13.5
v6.13.5.1
v6.13.6-rc1
v6.13.6
v6.13.6.2
v6.13.6.3

Packagist / ezsystems/ezpublish-kernel

Package

Name
ezsystems/ezpublish-kernel
Purl
pkg:composer/ezsystems/ezpublish-kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.4.0
Fixed
5.4.15