Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

jackalope/jackalope-doctrine-dbal

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.5PackagistPublished

    SQL injection in jackalope/jackalope-doctrine-dbal

    CVE-2021-43822 · GHSA-ph98-v78f-jqrm

    Affected
    • Packagist jackalope/jackalope-doctrine-dbal < 1.7.4
    Fixed in
    1.7.4· Vendor fix available
    Issue
    Impact Users can provoke SQL injections if they can specify a node name or query. Patches Upgrade to version 1.7.4 If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property). Workarounds Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected. References No further references. For more information If you have any questions or comments about this advisory: Open an issue in jackalope/jackalope-doctrine-dbal repo

    Recommended action: Upgrade to 1.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →