CVE-2019-18888
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-18888
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 4.3.8+dfsg-1 |
| debian | bullseye | fixed | 4.3.8+dfsg-1 |
| debian | forky | fixed | 4.3.8+dfsg-1 |
| debian | sid | fixed | 4.3.8+dfsg-1 |
| debian | trixie | fixed | 4.3.8+dfsg-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | symfony/http-foundation | >=2.0.0,<2.8.52 | 2.8.52 |
| Packagist | symfony/http-foundation | >=3.0.0,<3.4.35 | 3.4.35 |
| Packagist | symfony/http-foundation | >=4.0.0,<4.2.12 | 4.2.12 |
| Packagist | symfony/http-foundation | >=4.3.0,<4.3.8 | 4.3.8 |
| Packagist | symfony/mime | >=4.3.0,<4.3.8 | 4.3.8 |
| Packagist | symfony/symfony | >=2.0.0,<2.8.52 | 2.8.52 |
| Packagist | symfony/symfony | >=3.0.0,<3.4.35 | 3.4.35 |
| Packagist | symfony/symfony | >=4.0.0,<4.2.12 | 4.2.12 |
| Packagist | symfony/symfony | >=4.3.0,<4.3.8 | 4.3.8 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-18888
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml
- https://github.com/symfony/symfony/releases/tag/v4.3.8
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
- https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
- https://symfony.com/blog/symfony-4-3-8-released
- https://symfony.com/cve-2019-18888
- https://security-tracker.debian.org/tracker/CVE-2019-18888
Verify integrity in audit chain (admin only). AS-IS.