| Package | Affected versions | Patched versions |
|---|---|---|
| yiisoft/yii2 | < 2.0.38 | 2.0.38 |
| yii | < 2.0.38 | 2.0.38 |
Remote code execution in case application calls unserialize() on user input containing specially crafted string.
2.0.38
Add the following to BatchQueryResult.php:
public function __sleep()
{
throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}
public function __wakeup()
{
throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
If you have any questions or comments about this advisory, contact us through security form.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free