GHSA-484f-743f-6jx2 — medium GitHub Advisory (CVE-2019-16774) in composer/phpfastcache/phpfastcache

Description

An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).

The issue has been addressed by enforcing JSON conversion when deserializing

If you can't fix it, use another driver such as "Files" (Filesystem)

Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13

If you have any questions or comments about this advisory:
* Open an issue in the issue tracker
* Email us at [email protected]

Score	Percentile
0.38%	58.69%

Base score	Version	Severity	Vector
4.4	3.1	—	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.

Type	Value
GHSA	GHSA-484f-743f-6jx2 ↗
CVE	CVE-2019-16774 ↗

CWE id	Name
CWE-94	Improper Control of Generation of Code ('Code Injection')

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
composer	phpfastcache/phpfastcache	>= 5.0.0, < 5.0.13	5.0.13	—