CVE-2020-5274: Exceptions displayed in non-debug configurations in Symfony
CVE-2020-5274: Fix Exception message escaping rendered by ErrorHandler
Other sources
Description -----------
When ErrorHandler renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-debug environments.
Resolution ----------
The ErrorHandler class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-debug environments.
The patches for this issue are available here and here for branch 4.4.
Credits -------
I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.
— GitHub
In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.0.4 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 4.4.4 - Upgrade
Upgrade
composer/symfony/error-handlerto a version that resolves this vulnerability.Fixed in 5.0.4 - Upgrade
Upgrade
composer/symfony/error-handlerto a version that resolves this vulnerability.Fixed in 4.4.4 - Upgrade
Upgrade
symfony/http-foundationto a version that resolves this vulnerability.Fixed in 4.4.5 - Upgrade
Upgrade
symfony/http-foundationto a version that resolves this vulnerability.Fixed in 5.0.5
Event History
Frequently Asked Questions
What is CVE-2020-5274?
CVE-2020-5274 is a vulnerability in Symfony before versions 5.0.5 and 4.4.5.
What is the severity of CVE-2020-5274?
The severity of CVE-2020-5274 is medium with a CVSS score of 5.4.
How does CVE-2020-5274 affect Symfony and ErrorHandler?
CVE-2020-5274 affects Symfony versions 4.4.0 to 4.4.4 and 5.0.0 to 5.0.4, as well as ErrorHandler versions in the same range.
What is the fix for CVE-2020-5274?
To fix CVE-2020-5274, upgrade to Symfony version 4.4.5 or 5.0.5, and upgrade ErrorHandler accordingly.
Are there any references for CVE-2020-5274?
Yes, you can find more information about CVE-2020-5274 at the following references: [link1], [link2], [link3].