CVE-2018-11408: Medium severity symfony vulnerability

Q: What is CVE-2018-11408?

CVE-2018-11408 is an open redirect vulnerability in the security handlers of Symfony.

Q: What is the severity of CVE-2018-11408?

The severity of CVE-2018-11408 is medium (6.1).

Q: Which versions of Symfony are affected by CVE-2018-11408?

Symfony versions 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 are affected by CVE-2018-11408.

Q: How can I fix CVE-2018-11408?

To fix CVE-2018-11408, you should update Symfony to version 2.7.48, 2.8.41, 3.3.17, 3.4.11, or 4.0.11.

Q: Where can I find more information about CVE-2018-11408?

You can find more information about CVE-2018-11408 at the following references: 1. [Symfony Security Advisory](https://symfony.com/cve-2018-11408) 2. [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2018-11408) 3. [Debian LTS Announcement](https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html)

Published May 25, 2018

Updated

CVE-2018-11408: Open redirect vulnerability on security handlers

Other sources

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.httputils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

Affected Software

18 affected componentsFixes available

composer/symfony/symfony>=2.7.38, <2.7.48, >=2.8.0, <2.8.41, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.3.17, >=3.4.0, <3.4.11, >=4.0.0, <4.0.11

composer/symfony/security-bundle>=2.7.38, <2.7.48, >=2.8.0, <2.8.41, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.3.17, >=3.4.0, <3.4.11, >=4.0.0, <4.0.11

composer/symfony/security-bundle>=4.0.0<4.0.11

4.0.11

composer/symfony/security-bundle>=3.4.0<3.4.11

3.4.11

composer/symfony/security-bundle>=3.3.0<3.3.17

3.3.17

composer/symfony/security-bundle>=2.8.0<2.8.41

2.8.41

composer/symfony/security-bundle>=2.7.0<2.7.48

2.7.48

composer/symfony/symfony>=4.0.0<4.0.11

4.0.11

composer/symfony/symfony>=3.4.0<3.4.11

3.4.11

composer/symfony/symfony>=3.3.0<3.3.17

3.3.17

composer/symfony/symfony>=2.8.0<2.8.41

2.8.41

composer/symfony/symfony>=2.7.0<2.7.48

2.7.48

SensioLabs Symfony>=2.7.0<2.7.48

SensioLabs Symfony>=2.8.0<2.8.41

SensioLabs Symfony>=3.3.0<3.3.17

SensioLabs Symfony>=3.4.0<3.4.11

SensioLabs Symfony>=4.0.0<4.0.11

Debian Debian Linux=8.0

Event History

May 25, 2018

Advisory Published

02:04 PM

Jun 13, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is CVE-2018-11408?

CVE-2018-11408 is an open redirect vulnerability in the security handlers of Symfony.

What is the severity of CVE-2018-11408?