Headline
Debian Security Advisory 5809-1
Debian Linux Security Advisory 5809-1 - Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to privilege escalation, information disclosure, incorrect validation or an open redirect.
-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5809-1 [email protected]://www.debian.org/security/ Moritz MuehlenhoffNovember 11, 2024 https://www.debian.org/security/faq- -------------------------------------------------------------------------Package : symfonyCVE ID : CVE-2024-50340 CVE-2024-50342 CVE-2024-50343 CVE-2024-50345Multiple vulnerabilities have been found in the Symfony PHP frameworkwhich could lead to privilege escalation, information disclosure,incorrect validation or an open redirect.For the stable distribution (bookworm), these problems have been fixed inversion 5.4.23+dfsg-1+deb12u3.We recommend that you upgrade your symfony packages.For the detailed security status of symfony please refer toits security tracker page at:https://security-tracker.debian.org/tracker/symfonyFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: [email protected] PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmcyVZAACgkQEMKTtsN8TjZCahAApzS2JYSnSrbhyvDcwh/74Ilxz9TYphGz0/tefvNjbjzxbtXlGSSrO//6M+wOV2q+H0+NWbhJTAnF89LKXZilojWu+swfr6taoKaIWr0YH/4uQ7fIDG4otZbJXvbW5N5lhhl+mmzVoa+T9KwLssAZS49YGJ/oPn1rSQN5mrx4ZPHKf441s+eNjgdO0tmlBUYkUlhkBhsTdpA6y80hnrYn/a8Xsli3zXnFx5+2AAScKHtWIyCHgYE4iQyOzlriL96EuNv06uKKbQVoMxSTaq5m9po8MmMl3WnlWQplDr6qYr+7INF3farb1Zi+yJoVvwV6tOOYTOE3xxqDlq6eez9p9z7vd2YopHcvXdr3qOZ/mHE4JZcL5kKebFhXzVRxK6u0XJZ6WYY+YQ4Fel8lGriZSd1jBvzGn428ePNV2HHUj/9tNqcKMwXEvytRkRUKwSTG/Adp4M2X5uThHcGPY+3UC+oHh6YWq6o4duVGfC1ZPsbxvkx39QxSducGT5fpcoe8Knf4U3ZfElXb/sbi3SYqugoUzCTNjNaYA58HD+cRMuFF6lZaBMJM7o6jN6/9tmJveckpNgE/n2h0jtk0EoKjD34E8CNdAuBstq0DXIlO++/KT5v04U7nWSaGVKJYZs3piCv5fRTtFxYVePOGMSiF3jq5r1WsHZa5AI1n0KHfxIE==SPKd-----END PGP SIGNATURE-----Related news
### Description The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. ### Resolution The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/ The patch for this issue is available [here](https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe8819) for branch 5.4. ### Credits We would like to thank Sam Mush for reporting the issue and Nicolas Grekas for providing the fix.
### Description It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. ### Resolution Symfony now uses the `D` regex modifier to match the entire input. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/7d1032bbead9a4229b32fa6ebca32681c80cb76f) for branch 5.4. ### Credits We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
### Description When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. ### Resolution The `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b) for branch 5.4. ### Credits We would like to thank Linus Karlsson for reporting the issue and Nicolas Grekas for providing the fix.
### Description When the `register_argc_argv` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. ### Resolution The `SymfonyRuntime` now ignores the `argv` values for non-cli SAPIs PHP runtimes The patch for this issue is available [here](https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa) for branch 5.4. ### Credits We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.