CVE-2024-50342: Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
Description
When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.
Resolution
The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.
The fisrt patch for this issue is available here for branch 5.4.
The second one is available here for branch 5.4 also.
Credits
We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.
Other sources
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50342?
CVE-2024-50342 has been classified as a moderate severity vulnerability due to the potential for IP/port enumeration.
How do I fix CVE-2024-50342?
To fix CVE-2024-50342, update your Symfony package to version 7.1.8, 6.4.15, or 5.4.47.
What software versions are affected by CVE-2024-50342?
CVE-2024-50342 affects Symfony versions from 5.4.0 to 5.4.46, 6.0.0 to 6.4.14, and 7.0.0 to 7.1.7.
What is the cause of CVE-2024-50342?
CVE-2024-50342 arises from improper handling of internal information by the NoPrivateNetworkHttpClient during host resolution.
Is there a workaround for CVE-2024-50342?
There is no official workaround for CVE-2024-50342; the recommended action is to upgrade to a patched version.