Description
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| symfony | symfony | >= 4.4.0 and < 4.4.7, >= 5.0.0 and < 5.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | symfony | 4.4.8-1 | — |
| Debian 13 | symfony | 4.4.8-1 | — |
| Debian 12 | symfony | 4.4.8-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | symfony/http-foundation | >= 4.4.0, < 4.4.7 | 4.4.7 | GHSA-mcx4-f5f5-4859 |
| Packagist | symfony/http-foundation | >= 5.0.0, < 5.0.7 | 5.0.7 | GHSA-mcx4-f5f5-4859 |
| Packagist | symfony/symfony | >= 4.4.0, < 4.4.7 | 4.4.7 | GHSA-mcx4-f5f5-4859 |
| Packagist | symfony/symfony | >= 5.0.0, < 5.0.7 | 5.0.7 | GHSA-mcx4-f5f5-4859 |