End of life: 1/31/2025, End of support: 1/31/2025, Latest version: 7.1.11
End of life: 1/31/2025, End of support: 1/31/2025, Latest version: 7.1.11
End of life: 7/31/2024, End of support: 7/31/2024, Latest version: 7.0.10
End of life: 7/31/2024, End of support: 7/31/2024, Latest version: 7.0.10
Description
The error message in WebhookController returns unescaped user-submitted input.
Resolution
WebhookController now doesn't return any user-submitted input in its response.
The patch for this issue is available here for branch 6.3.
Credits
We would like to thank Maxime Aknin for reporting the issue and to Nicolas Grekas for providing the fix.
Description
SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations.
Resolution
Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Robert Meijers for reporting the issue and providing the fix.
Impact Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices.
Affected applications are any that use:
A custom querybuilder option to limit the valid results; AND An EntityType with 'autocomplete' => true or a custom AsEntityAutocompleteField.
Under this circumstance, if an id is submitted, it is accepted even if the matching record would not be returned by the custom query built with querybuilder.
Patches
The problem has been fixed in symfony/ux-autocomplete version 2.11.2.
Workarounds Upgrade to version 2.11.2 or greater of symfony/ux-autocomplete or perform extra validation after submit to verify the selected option is valid.
End of life: 1/31/2024, End of support: 1/31/2024, Latest version: 6.3.12
End of life: 1/31/2024, End of support: 1/31/2024, Latest version: 6.3.12
CVE-2022-24895: Possible CSRF token fixation
CVE-2022-24894: Prevent storing cookie headers in HttpCache
End of life: 7/31/2023, End of support: 7/31/2023, Latest version: 6.2.14
End of life: 7/31/2023, End of support: 7/31/2023, Latest version: 6.2.14
End of life: 1/31/2023, End of support: 1/31/2023, Latest version: 6.1.12
End of life: 1/31/2023, End of support: 1/31/2023, Latest version: 6.1.12
CVE-2022-23601: CSRF token missing in forms
End of life: 1/31/2023, End of support: 1/31/2023, Latest version: 6.0.20
End of life: 1/31/2023, End of support: 1/31/2023, Latest version: 6.0.20
CVE-2021-41270: Prevent CSV Injection via formulas
CVE-2021-41268: Remember me cookie persistance after password changes
CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request
CVE-2021-32693: Authentication granted to all firewalls instead of just one
End of life: 1/1/2022, End of support: 1/1/2022, Latest version: 5.3.16
End of life: 1/1/2022, End of support: 1/1/2022, Latest version: 5.3.16
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
End of life: 7/21/2021, End of support: 7/21/2021, Latest version: 5.2.14
End of life: 7/21/2021, End of support: 7/21/2021, Latest version: 5.2.14
CVE-2020-15094: Prevent RCE when calling untrusted remote with CachingHttpClient
End of life: 1/21/2021, End of support: 1/21/2021, Latest version: 5.1.11
End of life: 1/21/2021, End of support: 1/21/2021, Latest version: 5.1.11