VDB
Sign up
MEDIUM

GHSA-qmqw-mpqp-mr54

Symfony Incorrect Access Control

Quick fix

GHSA-qmqw-mpqp-mr54 — symfony/http-kernel: upgrade to the fixed version with the command below.

composer require symfony/http-kernel:^2.3.29

Details

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the `_controller` attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to `/_fragment`.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/symfony/http-kernel
Introduced in: 2.3.19Fixed in: 2.3.29
Fixcomposer require symfony/http-kernel:^2.3.29
Packagist/symfony/http-kernel
Introduced in: 2.5.4Fixed in: 2.5.12
Fixcomposer require symfony/http-kernel:^2.5.12
Packagist/symfony/http-kernel
Introduced in: 2.6.0Fixed in: 2.6.8
Fixcomposer require symfony/http-kernel:^2.6.8
Packagist/symfony/symfony
Introduced in: 2.3.19Fixed in: 2.3.29
Fixcomposer require symfony/symfony:^2.3.29
Packagist/symfony/symfony
Introduced in: 2.4.9

No fixed version published yet for symfony/symfony (composer). Pin to a known-safe version or switch to an alternative.

Packagist/symfony/symfony
Introduced in: 2.5.4Fixed in: 2.5.12
Fixcomposer require symfony/symfony:^2.5.12
Packagist/symfony/symfony
Introduced in: 2.6.0Fixed in: 2.6.8
Fixcomposer require symfony/symfony:^2.6.8
Packagist/symfony/http-kernel
Introduced in: 2.4.9

No fixed version published yet for symfony/http-kernel (composer). Pin to a known-safe version or switch to an alternative.

References