Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

friendsofsymfony/rest-bundle

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedPackagistPublished

    FOSRestBundle issue with broken validation of JSONP callbacks

    GHSA-p9fg-j6ww-953m

    Affected
    • Packagist friendsofsymfony/rest-bundle >= 1.2.0, < 1.2.2
    Fixed in
    1.2.2· Vendor fix available
    Issue
    Starting with FOSRestBundle 1.2 we switched to using willdurand/jsonp-callback-validator for validation of JSONP callbacks. However the change was implemented incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle 1.2.2.

    Recommended action: Upgrade to 1.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →