Fedora Account System
Red Hat Associate
Red Hat Customer
It was found that specially crafted input to unserialize, an exception object which refers to itself as the previous exception, may cause exception::__toString never to terminate, causing infinite loop. Upstream bug: https://bugs.php.net/bug.php?id=73093 External Reference: https://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf
This issue happens when untrusted input is unserialized. Doing so is documented as being unsafe: http://php.net/manual/en/function.unserialize.php Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user.