GHSA-x8vp-gf4q-mw5j
Symfony allows changing the environment through a query
Quick fix
GHSA-x8vp-gf4q-mw5j — symfony/runtime: upgrade to the fixed version with the command below.
composer require symfony/runtime:^5.4.46Details
### Description
When the `register_argc_argv` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.
### Resolution
The `SymfonyRuntime` now ignores the `argv` values for non-cli SAPIs PHP runtimes
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa) for branch 5.4.
### Credits
We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.
Are you affected?
Enter the version of the package you're using.
Affected packages
5.3.0Fixed in: 5.4.46composer require symfony/runtime:^5.4.466.0.0Fixed in: 6.4.14composer require symfony/runtime:^6.4.147.0.0Fixed in: 7.1.7composer require symfony/runtime:^7.1.75.3.0Fixed in: 5.4.46composer require symfony/symfony:^5.4.466.0.0Fixed in: 6.4.14composer require symfony/symfony:^6.4.147.0.0Fixed in: 7.1.7composer require symfony/symfony:^7.1.7References
- https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-50340[ADVISORY]
- https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/runtime/CVE-2024-50340.yaml[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50340.yaml[WEB]
- https://github.com/symfony/symfony[PACKAGE]
- https://symfony.com/cve-2024-50340[WEB]