CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
Other sources
Description -----------
When a Response does not contain a Content-Type header, Symfony falls back to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.
Resolution ----------
Symfony does not use the Accept header anymore to guess the Content-Type.
The patch for this issue is available here for the 4.4 branch.
Credits -------
I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.
— GitHub
In Symfony before versions 4.4.7 and 5.0.7, when a Response does not contain a Content-Type header, affected versions of Symfony can fallback to the format defined in the Accept header of the request, leading to a possible mismatch between the response's content and Content-Type header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
composer/symfony/http-foundationto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
composer/symfony/http-foundationto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Symfonyto a version that resolves this vulnerability.Fixed in 5.0.7
Event History
Frequently Asked Questions
What is CVE-2020-5255?
CVE-2020-5255 is a vulnerability that allows cache poisoning via a Response Content-Type header.
What is the severity of CVE-2020-5255?
The severity of CVE-2020-5255 is medium with a CVSS score of 4.3.
How does CVE-2020-5255 affect Symfony?
Versions of Symfony before 4.4.7 and 5.0.7 are affected by CVE-2020-5255.
How can I fix CVE-2020-5255?
To fix CVE-2020-5255, upgrade to Symfony version 4.4.7 or 5.0.7 or later.
Where can I find more information about CVE-2020-5255?
You can find more information about CVE-2020-5255 at the following references: [link1] [link2] [link3].