VDB
GHSA-92rv-4j2h-8mjj
GHSA-92rv-4j2h-8mjj
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Snappy PHAR deserialization vulnerability
Record from GitHub Advisory Database · Published September 8, 2023
knplabs/knp-snappy is fixed in 1.4.3 (Packagist)
Snappy PHAR deserialization vulnerability
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| knplabs/knp-snappy | Packagist | 1.4.3 |
Risk scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| wolfi | snappy | * |
| knplabs | knp-snappy | 0 |
| chainguard | snappy | * |
Timeline
- Sep 8, 2023 CVE Published
- Apr 9, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-92rv-4j2h-8mjj
vulnetix vdb fixes GHSA-92rv-4j2h-8mjjOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-92rv-4j2h-8mjj/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/KnpLabs/snappy/commit/d3b742d61a68bf93866032c2c0a7f1486128b67e url
- https://github.com/KnpLabs/snappy package
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-92rv-4j2h-8mjj url
- https://nvd.nist.gov/vuln/detail/CVE-2023-41330 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/knplabs/knp-snappy/CVE-2023-41330.yaml url
- https://github.com/advisories/GHSA-92rv-4j2h-8mjj advisory
- https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc url