Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS00NDJmLXdjd3EtZnBjZs4AAv_K
Prevent RCE when deserializing untrusted user input
Impact
Affected versions of yiisoft/yii
are vulnerable to Remote Code Execution (RCE) if the application calls unserialize()
on arbitrary user input.
Patches
Upgrade yiisoft/yii
to version 1.1.27 or higher.
For more information
See the following links for more details:
If you have any questions or comments about this advisory, contact us through security form.
Permalink: https://github.com/advisories/GHSA-442f-wcwq-fpcfJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00NDJmLXdjd3EtZnBjZs4AAv_K
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: about 1 year ago
CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-442f-wcwq-fpcf, CVE-2022-41922
References:
- https://github.com/yiisoft/yii/security/advisories/GHSA-442f-wcwq-fpcf
- https://nvd.nist.gov/vuln/detail/CVE-2022-41922
- https://github.com/yiisoft/yii/commit/ed67b7cc57216557c5c595c6650cdd2d3aa41c52
- https://github.com/advisories/GHSA-442f-wcwq-fpcf
Blast Radius: 25.3
Affected Packages
packagist:yiisoft/yii
Dependent packages: 302Dependent repositories: 1,325
Downloads: 4,358,461 total
Affected Version Ranges: < 1.1.27
Fixed in: 1.1.27
All affected versions: 1.1.14, 1.1.15, 1.1.16, 1.1.17, 1.1.18, 1.1.19, 1.1.20, 1.1.21, 1.1.22, 1.1.23, 1.1.24, 1.1.25, 1.1.26
All unaffected versions: 1.1.27, 1.1.28, 1.1.29