Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When investigating issue #11093, Jeremy Derussé found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. - Your Symfony application is vulnerable if you meet the following conditions: - You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a locale argument for instance): When vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.
Recommended action: Upgrade to 2.5.2, 2.4.8 or 2.3.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
----------- The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. Resolution ---------- Symfony restored the default configuration to enable the CSRF protection by default. The patch for this issue is available here for branch 5.3. Credits ------- We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Recommended action: Upgrade to 6.0.4, 5.4.4 or 5.3.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.8.504.1.122.7.514.2.73.4.26· Vendor fix available
Issue
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
Recommended action: Upgrade to 4.2.7, 4.1.12, 3.4.26 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.