Security Digest · Critical advisory (no CVE assigned)
GHSA-6q9v-4hq6-5m67: Doctrine SQL injection vulnerability
Doctrine is prone to SQL injection vulnerability.
GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | doctrine/orm | >= 2.0.0, < 2.0.3 | 2.0.3 |
| Composer (PHP) | doctrine/orm | >= 1.0.0, < 1.2.4 | 1.2.4 |
Details
Doctrine is prone to SQL injection vulnerability. Users of Doctrine 1.2 and 2 should update to the newly released versions of both libraries immediately. Both versions only include the security fix and no other changes to their previous versions 1.2.3 and 2.0.2.
Affected versions are: - 1.2.3 and earlier for PostgreSQL and DB2 Dialects - 2.0.2 and earlier
The security issue was found to affect the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() function which does not cast input values for limit and offset to integer and allows malicious SQL to be executed if these parameters are passed into Doctrine 2 directly from request variables without previous cast to integer. Functionality building on top using limit queries in the ORM such as Doctrine\ORM\Query::setFirstResult() and Doctrine\ORM\Query::setMaxResults() are also affected by this security issue.
The fix for this security issue breaks backwards compatibility for developers that extend the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery() method, because it is now marked as final. Please overwrite the Doctrine\DBAL\Platforms\AbstractPlatform::doModifyLimitQuery() method instead.
Sources and references
- GitHub Advisory GHSA-6q9v-4hq6-5m67 github.com
- github.com github.com
- web.archive.org web.archive.org
Critical Composer (PHP) advisories · Today’s Security Digest