HIGH

GHSA-vjrg-wpm8-rhrw

doctrine/orm Regression in Query Parenthesis can have Security Implications

Quick fix

GHSA-vjrg-wpm8-rhrw — doctrine/orm: upgrade to the fixed version with the command below.

composer require doctrine/orm:^2.8.4

Details

An issue identified in doctrine/orm project related to statement in Where-Clause were not wrapped in brackets due to improper hadandling of case insensitive check.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/doctrine/orm

Introduced in: 2.8.3Fixed in: 2.8.4

Fixcomposer require doctrine/orm:^2.8.4

References

https://github.com/doctrine/orm/pull/8591[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/doctrine/orm/2021-04-06.yaml[WEB]
https://github.com/doctrine/orm[PACKAGE]