symfony - security update

Fixed packages 1

Vulnerabilities 4

• Critical 9.8
  CVE-2019-10910

  Symfony Service IDs Allow Injection

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

  symfony/symfony symfony symfony symfony/dependency-injection Debian Ubuntu Packagist
  May 16, 2019
• Critical 9.8
  CVE-2019-10913

  Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injectio…

  symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist
  May 16, 2019
• High 7.5
  CVE-2019-10911

  Improper authentication in Symfony

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabl…

  symfony/symfony symfony symfony symfony/security-http Debian Ubuntu Packagist
  May 16, 2019
• Medium 5.4
  CVE-2019-10909 Public exploit

  Symfony Cross-site Scripting (XSS) vulnerability

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

  drupal/core symfony/symfony symfony symfony Debian Ubuntu Packagist
  May 16, 2019