CVE-2021-43822
Description
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
jackalope/jackalope-doctrine-dbalPackagist | < 1.7.4 | 1.7.4 |
Affected products
2- Range: < 1.7.4
Patches
Vulnerability mechanics
References
4- github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231dbnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-ph98-v78f-jqrmghsaADVISORY
- github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrmnvdMitigationThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-43822ghsaADVISORY
News mentions
0No linked articles in our index yet.