HighGHSA-76w8-mqx4-wjrf

Doctrine DBAL SQL injection possibility

Published 15 May 2024 · Updated 15 May 2024

Affected packages

doctrine/dbalComposer

Affected: >=2.0.0 <2.0.8
Fixed in: 2.0.8

Update to the fixed version for your release line, for example:composer require doctrine/dbal:^2.0.8

doctrine/dbalComposer

Affected: >=2.1.0 <2.1.2
Fixed in: 2.1.2

Update to the fixed version for your release line, for example:composer require doctrine/dbal:^2.1.2

Details

The identifier quoting in Doctrine DBAL has a potential security problem when user-input is passed into this function, making the security aspect of this functionality obsolete. If you make use of AbstractPlatform::quoteIdentifier() or Doctrine::quoteIdentifier() please upgrade immediately. The ORM itself does not use identifier quoting in combination with user-input, however we still urge everyone to update to the latest version of DBAL.

Is GHSA-76w8-mqx4-wjrf in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected doctrine/dbal, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.