SB2019111392 - Fedora 30 update for php-symfony

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019111392

SB2019111392 - Fedora 30 update for php-symfony

Published: November 13, 2019 Updated: April 25, 2025

Security Bulletin ID SB2019111392
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2019-18888)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists in MimeTypeGuesser within the Symfony HttpFoundation component when parsing data passed via the $path variable. A remote attacker can with ability to upload files can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Incorrect Comparison (CVE-ID: CVE-2019-18887)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists within the HttpKernel component in Symfony when checking the signature of an URI (an ESI fragment URL for instance) due to the URISigner does not use a constant time string comparison function. A remote attacker can perform a timing attack and gain access to sensitive functionality.


Remediation

Install update from vendor's website.

References