LOW 3.7
GHSA-r5pm-vrc5-3m73
cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions
Quick fix
GHSA-r5pm-vrc5-3m73 — cakephp/queue: upgrade to the fixed version with the command below.
composer require cakephp/queue:^2.3.1Details
### Impact
For jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
### Patches Upgrade to 2.3.1
### Workarounds
You can disable `shouldBeUnique` and handle idempotency in application code.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist / cakephp/queue
Introduced in:
0.1.10 Fixed in: 2.3.1 Fix
composer require cakephp/queue:^2.3.1 References
- https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73 [WEB]
- https://github.com/cakephp/queue/pull/188 [WEB]
- https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34 [WEB]
- https://github.com/cakephp/queue [PACKAGE]
- https://github.com/cakephp/queue/releases/tag/2.3.1 [WEB]