Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The custom userchecker defined on a firewall is not called when Login Programmaticaly with the Security::login method, leading to unwanted login. Resolution The Security::login method now ensure to call the configured userchecker. The patch for this issue is available here for branch 6.4. Credits We would like to thank Oleg Andreyev, Antoine MAKDESSI for reporting the issue and Christian Flothmann for providing the fix.
Recommended action: Upgrade to 7.1.3, 7.0.10 or 6.4.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
6.0.206.2.65.4.206.1.124.4.50· Vendor fix available
Issue
----------- When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. Resolution ---------- Symfony removes all CSRF tokens from the session on successful login. The patch for this issue is available here for branch 4.4. Credits ------- We would like to thank Marco Squarcina for reporting the issue and Nicolas Grekas for fixing it.
Recommended action: Upgrade to 6.2.6, 6.1.12, 6.0.20 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.7.484.0.112.8.413.3.173.4.11· Vendor fix available
Issue
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.httputils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.
Recommended action: Upgrade to 4.0.11, 3.4.11, 3.3.17 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.7.484.0.112.8.413.3.173.4.11· Vendor fix available
Issue
An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidatesession option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.
Recommended action: Upgrade to 4.0.11, 3.4.11, 3.3.17 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
----------- Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Resolution ---------- Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore. The patch for this issue is available here for branch 5.3. Credits ------- We would like to thank Thibaut Decherit for reporting the issue and Wouter J for fixing the issue.
Recommended action: Upgrade to 5.3.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.