GHSA-9c3x-r3wp-mgxm
Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient
Quick fix
GHSA-9c3x-r3wp-mgxm — symfony/http-client: upgrade to the fixed version with the command below.
composer require symfony/http-client:^5.4.47Details
### Description
When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.
### Resolution
The `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks.
The fisrt patch for this issue is available [here](https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b) for branch 5.4.
The second one is available [here](https://github.com/symfony/symfony/commit/b4bf5afdbdcb2fd03da513ee03beeabeb551e5fa) for branch 5.4 also.
### Credits
We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.
Are you affected?
Enter the version of the package you're using.
Affected packages
4.3.0Fixed in: 5.4.47composer require symfony/http-client:^5.4.476.0.0Fixed in: 6.4.15composer require symfony/http-client:^6.4.157.0.0Fixed in: 7.1.8composer require symfony/http-client:^7.1.84.3.0Fixed in: 5.4.47composer require symfony/symfony:^5.4.476.0.0Fixed in: 6.4.15composer require symfony/symfony:^6.4.157.0.0Fixed in: 7.1.8composer require symfony/symfony:^7.1.8References
- https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxm[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-50342[ADVISORY]
- https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520f5b[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-client/CVE-2024-50342.yaml[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50342.yaml[WEB]
- https://github.com/symfony/symfony[PACKAGE]
- https://symfony.com/cve-2024-50342[WEB]