composer提示有安全漏洞

[YvesHo0968]

所属功能组件

其它

ThinkPHP 版本

8.0.3

操作系统

mac

错误信息

composer audit

Found 2 security vulnerability advisories affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | topthink/framework                                                               |
| Severity          | critical                                                                         |
| CVE               | CVE-2024-44902                                                                   |
| Title             | ThinkPHP deserialization vulnerability                                           |
| URL               | https://github.com/advisories/GHSA-f4wh-359g-4pq7                                |
| Affected versions | >=6.1.3,<=8.0.4                                                                  |
| Reported at       | 2024-09-09T21:31:23+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | topthink/framework                                                               |
| Severity          | medium                                                                           |
| CVE               | CVE-2024-34467                                                                   |
| Title             | ThinkPHP Cross-Site Scripting Vulnerability                                      |
| URL               | https://github.com/advisories/GHSA-969f-v7jv-pgj3                                |
| Affected versions | <6.0.17|>=6.1.0,<6.1.5|>=8.0.0,<8.0.4                                            |
| Reported at       | 2024-05-04T21:30:33+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

其它说明

No response

[liu21st]

第二个最新版是没问题的 第一个漏洞但凡有点安全意识的基本都不用担心 没有一个项目会傻到这种程度去反序列化用户输入的东西

[big-dream]

Duplicate of #3059