Advisory Weakness Curation

Unsafe deserialization in Yii 2 ### Impact Remote code execution in case application calls `unserialize()` on user input containing specially crafted string. ### Patches 2.0.38 ### Workarounds Add the following to BatchQueryResult.php: ```php public function __sleep() { throw new \BadMethodCallException('Cannot serialize '.__CLASS__); } public function __wakeup() { throw new \BadMethodCallException('Cannot unserialize '.__CLASS__); } ``` ### For more information If you have any questions or comments about this advisory, contact us through security form https://www.yiiframework.com/security.

Deserialization of Untrusted Data Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.

Deserialization of Untrusted Data Yii 2 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input.