SB2019111916 - Debian update for symfony

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Deserialization of Untrusted Data (CVE-ID: CVE-2019-18889)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the AbstractAdapter and TagAwareAdapter instances within the Symfony Cache component. A remote attacker can pass specially crafted data to to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) OS Command Injection (CVE-ID: CVE-2019-18888)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists in MimeTypeGuesser within the Symfony HttpFoundation component when parsing data passed via the $path variable. A remote attacker can with ability to upload files can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Incorrect Comparison (CVE-ID: CVE-2019-18887)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists within the HttpKernel component in Symfony when checking the signature of an URI (an ESI fragment URL for instance) due to the URISigner does not use a constant time string comparison function. A remote attacker can perform a timing attack and gain access to sensitive functionality.

Remediation

Install update from vendor's website.

References

• https://www.debian.org/security/2019/dsa-4573