Skip to content
OpenAdvisories
High DLA-1999-1 3 CVEs

symfony - security update

Published Nov 18, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 symfony 2.3.21+dfsg-4+deb8u6

Vulnerabilities 3

  • High 8.1
    CVE-2019-18887

    Symfony Http-Kernel has non-constant time comparison in UriSigner

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.

    symfony/symfony symfony symfony symfony/http-kernel Debian Ubuntu Packagist
  • High 7.5
    CVE-2019-18888

    Argument injection in a MimeTypeGuesser in Symfony

    An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are…

    symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist
  • Medium 5.3
    CVE-2019-18886

    User enumeration leak using switch user functionality in Symfony

    An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is…

    symfony/symfony symfony symfony/security-http Debian Packagist