[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 3493-1] symfony security update

Debian LTS Advisory DLA-3493-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
July 11, 2023                                 https://wiki.debian.org/LTS

Package        : symfony
Version        : 3.4.22+dfsg-2+deb10u2
CVE ID         : CVE-2021-21424 CVE-2022-24894 CVE-2022-24895

Multiple security vulnerabilities were found in symfony, a PHP framework
for web and console applications and a set of reusable PHP components,
which could lead to information disclosure or impersonation.


    James Isaac, Mathias Brodala and Laurent Minguet discovered that it
    was possible to enumerate users without relevant permissions due to
    different exception messages depending on whether the user existed
    or not.  It was also possible to enumerate users by using a timing
    attack, by comparing time elapsed when authenticating an existing
    user and authenticating a non-existing user.

    403s are now returned whether the user exists or not if a user
    cannot switch to a user or if the user does not exist.


    Soner Sayakci discovered that when the Symfony HTTP cache system is
    enabled, the response header might be stored with a `Set-Cookie`
    header and returned to some other clients, thereby allowing an
    attacker to retrieve the victim's session.

    The `HttpStore` constructor now takes a parameter containing a list
    of private headers that are removed from the HTTP response headers.
    The default value for this parameter is `Set-Cookie`, but it can be
    overridden or extended by the application.


    Marco Squarcina discovered that CSRF tokens aren't cleared upon
    login, which could enable same-site attackers to bypass the CSRF
    protection mechanism by performing an attack similar to a

For Debian 10 buster, these problems have been fixed in version

We recommend that you upgrade your symfony packages.

For the detailed security status of symfony please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: PGP signature

Reply to: