symfony - security update

Fixed packages 1

Vulnerabilities 8

• Critical 9.8
  CVE-2019-10910

  Symfony Service IDs Allow Injection

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

  symfony/symfony symfony symfony symfony/dependency-injection Debian Ubuntu Packagist
  May 16, 2019
• Critical 9.8
  CVE-2019-10913

  Invalid HTTP method overrides allow possible XSS or other attacks in Symfony

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injectio…

  symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist
  May 16, 2019
• High 7.5
  CVE-2019-10911

  Improper authentication in Symfony

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabl…

  symfony/symfony symfony symfony symfony/security-http Debian Ubuntu Packagist
  May 16, 2019
• High 7.1
  CVE-2019-10912

  Deserialization of untrusted data in Symfony

  In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has …

  typo3/cms typo3/cms-core symfony/symfony symfony Debian Ubuntu Packagist
  May 16, 2019
• Medium 6.5
  CVE-2018-14773 EPSS 58%

  Symfony HTTP Foundation web cache poisoning

  An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users overr…

  symfony/symfony symfony symfony symfony/http-foundation Debian Ubuntu Packagist
  Aug 3, 2018
• Medium 6.1
  CVE-2018-19790

  Symfony Open Redirect

  An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can wor…

  symfony/symfony symfony symfony symfony/security-http Debian Ubuntu Packagist
  Dec 18, 2018
• Medium 5.4
  CVE-2019-10909 Public exploit

  Symfony Cross-site Scripting (XSS) vulnerability

  In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.

  drupal/core symfony/symfony symfony symfony Debian Ubuntu Packagist
  May 16, 2019
• Medium 5.3
  CVE-2018-19789

  Symfony Path Disclosure

  An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a cl…

  symfony/symfony symfony symfony symfony/form Debian Ubuntu Packagist
  Dec 18, 2018