~ / search / GHSA-7hwc-2cq4-6x2w

GHSA-7hwc-2cq4-6x2w

Symfony Open Redirect

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-11408

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/symfony >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/symfony >= 3.3.0, < 3.3.17 3.3.17
Packagist symfony/symfony >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/symfony >= 4.0.0, < 4.0.11 4.0.11
Packagist symfony/security-bundle >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/security-bundle >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/security-bundle >= 3.3.0, < 3.3.17 3.3.17
Packagist symfony/security-bundle >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/security-bundle >= 4.0.0, < 4.0.11 4.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

References

External links from the advisory. They lead to third-party sites.