| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/symfony | ≥ 2.0.0, < 2.0.24≥ 2.1.0, < 2.1.12≥ 2.2.0, < 2.2.5≥ 2.3.0, < 2.3.3 | 2.0.242.1.122.2.52.3.3 |
| symfony/validator | ≥ 2.0.0, < 2.0.24≥ 2.1.0, < 2.1.12≥ 2.2.0, < 2.2.5≥ 2.3.0, < 2.3.3 | 2.0.242.1.122.2.52.3.3 |
| symfony | ≥ 2.0.0, < 2.0.24≥ 2.1.0, < 2.1.12≥ 2.2.0, < 2.2.5≥ 2.3.0, < 2.3.3 | 2.0.242.1.122.2.52.3.3 |
When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).
As a consequence, arrays or traversable objects stored in fields using the @Valid constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free