symfony/security (Packagist)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 5.2.8 or later clears every advisory below that has a fix.

Upgrade commands

composer

composer require symfony/security:^5.2.8

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-q87v-q8fw-gmj5 Symfony Incorrect Access Control	Critical EPSS 1.85%	`>= 2.7.30, < 2.7.32`	`2.7.32`
GHSA-q87v-q8fw-gmj5 Symfony Incorrect Access Control	Critical EPSS 1.85%	`>= 2.8.23, < 2.8.25`	`2.8.25`
GHSA-q87v-q8fw-gmj5 Symfony Incorrect Access Control	Critical EPSS 1.85%	`>= 3.2.10, < 3.2.12`	`3.2.12`
GHSA-q87v-q8fw-gmj5 Symfony Incorrect Access Control	Critical EPSS 1.85%	`>= 3.3.3, < 3.3.5`	`3.3.5`
GHSA-83c3-qx27-2rwr Symfony Allows URI Restrictions Bypass Via Double-Encoded String	Medium EPSS 1.88%	`>= 2.0.0, < 2.0.19`	`2.0.19`
GHSA-cr49-fx2v-9p57 Symfony Denial of Service Via Long Password Hashing	Medium EPSS 1.87%	`>= 2.0.0, < 2.0.25`	`2.0.25`
GHSA-cr49-fx2v-9p57 Symfony Denial of Service Via Long Password Hashing	Medium EPSS 1.87%	`>= 2.3.0, < 2.3.6`	`2.3.6`
GHSA-cr49-fx2v-9p57 Symfony Denial of Service Via Long Password Hashing	Medium EPSS 1.87%	`>= 2.2.0, < 2.2.9`	`2.2.9`
GHSA-cr49-fx2v-9p57 Symfony Denial of Service Via Long Password Hashing	Medium EPSS 1.87%	`>= 2.1.0, < 2.1.13`	`2.1.13`
GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames	High EPSS 1.86%	`>= 2.4.0, < 2.7.13`	`2.7.13`
GHSA-jjx5-fq5g-8xpc Symfony Cryptographic Vulnerability	High EPSS 1.91%	`>= 2.7.0, < 2.7.9`	`2.7.9`
GHSA-jjx5-fq5g-8xpc Symfony Cryptographic Vulnerability	High EPSS 1.91%	`>= 2.4.0, < 2.6.13`	`2.6.13`
GHSA-jjx5-fq5g-8xpc Symfony Cryptographic Vulnerability	High EPSS 1.91%	`>= 2.3.0, < 2.3.37`	`2.3.37`
GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames	High EPSS 1.86%	`>= 2.8.0, < 2.8.6`	`2.8.6`
GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames	High EPSS 1.86%	`>= 3.0.0, < 3.0.6`	`3.0.6`
GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames	High EPSS 1.86%	`>= 2.3.0, < 2.3.41`	`2.3.41`
GHSA-g97c-jfx6-xvxh Symfony Vulnerable to Timing Attack	High EPSS 2.54%	`>= 2.3.0, < 2.3.35`	`2.3.35`
GHSA-g97c-jfx6-xvxh Symfony Vulnerable to Timing Attack	High EPSS 2.54%	`>= 2.7.0, < 2.7.7`	`2.7.7`
GHSA-g97c-jfx6-xvxh Symfony Vulnerable to Timing Attack	High EPSS 2.54%	`>= 2.4.0, < 2.6.12`	`2.6.12`
GHSA-35c5-28pg-2qg4 Symfony Authentication Bypass	Critical EPSS 2.37%	`>= 3.0.0, < 3.3.17`	`3.3.17`
GHSA-35c5-28pg-2qg4 Symfony Authentication Bypass	Critical EPSS 2.37%	`>= 3.4.0, < 3.4.7`	`3.4.7`
GHSA-35c5-28pg-2qg4 Symfony Authentication Bypass	Critical EPSS 2.37%	`>= 2.8.0, < 2.8.37`	`2.8.37`
GHSA-35c5-28pg-2qg4 Symfony Authentication Bypass	Critical EPSS 2.37%	`>= 4.0.0, < 4.0.7`	`4.0.7`
GHSA-wvj5-r78r-hhfq Symfony Authentication Bypass	Critical EPSS 4.29%	`>= 3.0.0, < 3.0.6`	`3.0.6`
GHSA-wvj5-r78r-hhfq Symfony Authentication Bypass	Critical EPSS 4.29%	`>= 2.8.0, < 2.8.6`	`2.8.6`
GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability	Low EPSS 2.71%	`>= 2.3.0, < 2.3.35`	`2.3.35`
GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability	Low EPSS 2.71%	`>= 2.7.0, < 2.7.7`	`2.7.7`
GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability	Low EPSS 2.71%	`>= 2.4.0, < 2.6.12`	`2.6.12`
GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability	High EPSS 1.97%	`>= 4.0.0, < 4.0.11`	`4.0.11`
GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability	High EPSS 1.97%	`>= 2.7.0, < 2.7.48`	`2.7.48`
GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability	High EPSS 1.97%	`>= 3.4.0, < 3.4.11`	`3.4.11`
GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability	High EPSS 1.97%	`>= 3.0.0, < 3.3.17`	`3.3.17`
GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability	High EPSS 1.97%	`>= 2.8.0, < 2.8.41`	`2.8.41`
GHSA-r7p7-qr7p-2rrf Symfony Open Redirect	Medium EPSS 0.77%	`>= 3.2.0, < 3.2.14`	`3.2.14`
GHSA-r7p7-qr7p-2rrf Symfony Open Redirect	Medium EPSS 0.77%	`>= 2.7.0, < 2.7.38`	`2.7.38`
GHSA-r7p7-qr7p-2rrf Symfony Open Redirect	Medium EPSS 0.77%	`>= 3.3.0, < 3.3.13`	`3.3.13`
GHSA-r7p7-qr7p-2rrf Symfony Open Redirect	Medium EPSS 0.77%	`>= 2.8.0, < 2.8.31`	`2.8.31`
GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation	High EPSS 0.75%	`>= 3.4.0, < 3.4.11`	`3.4.11`
GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation	High EPSS 0.75%	`>= 3.0.0, < 3.3.17`	`3.3.17`
GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation	High EPSS 0.75%	`>= 2.8.0, < 2.8.41`	`2.8.41`
GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation	High EPSS 0.75%	`>= 2.7.0, < 2.7.48`	`2.7.48`
GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation	High EPSS 0.75%	`>= 4.0.0, < 4.0.11`	`4.0.11`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 2.7.38, < 2.7.50`	`2.7.50`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 4.2.0, < 4.2.1`	`4.2.1`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 4.1.0, < 4.1.9`	`4.1.9`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 4.0.0, < 4.0.15`	`4.0.15`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 3.0.0, < 3.4.19`	`3.4.19`
GHSA-89r2-5g34-2g47 Symfony Open Redirect	Medium EPSS 1.49%	`>= 2.8.0, < 2.8.49`	`2.8.49`
GHSA-92x6-h2gr-8gxq Symfony CSRF Vulnerability	Medium EPSS 1.49%	`>= 2.7.0, < 2.7.38`	`2.7.38`
GHSA-92x6-h2gr-8gxq Symfony CSRF Vulnerability	Medium EPSS 1.49%	`>= 3.3.0, < 3.3.13`	`3.3.13`
GHSA-92x6-h2gr-8gxq Symfony CSRF Vulnerability	Medium EPSS 1.49%	`>= 3.0.0, < 3.2.14`	`3.2.14`
GHSA-92x6-h2gr-8gxq Symfony CSRF Vulnerability	Medium EPSS 1.49%	`>= 2.8.0, < 2.8.31`	`2.8.31`
GHSA-5pv8-ppvj-4h68 Prevent user enumeration using Guard or the new Authenticator-based Security	Medium EPSS 1.64%	`>= 5.0.0, < 5.2.8`	`5.2.8`
GHSA-5pv8-ppvj-4h68 Prevent user enumeration using Guard or the new Authenticator-based Security	Medium EPSS 1.64%	`>= 2.8.0, < 3.4.49`	`3.4.49`
GHSA-5pv8-ppvj-4h68 Prevent user enumeration using Guard or the new Authenticator-based Security	Medium EPSS 1.64%	`>= 4.0.0, < 4.4.24`	`4.4.24`
GHSA-g4m9-5hpf-hx72 Firewall configured with unanimous strategy was not actually unanimous in Symfony	High EPSS 1.15%	`>= 4.4.0, < 4.4.7`	`4.4.7`
GHSA-g4m9-5hpf-hx72 Firewall configured with unanimous strategy was not actually unanimous in Symfony	High EPSS 1.15%	`>= 5.0.0, < 5.0.7`	`5.0.7`
GHSA-cchx-mfrc-fwqr Improper authentication in Symfony	High EPSS 1.21%	`>= 4.2.0, < 4.2.7`	`4.2.7`
GHSA-cchx-mfrc-fwqr Improper authentication in Symfony	High EPSS 1.21%	`>= 3.0.0, < 3.4.26`	`3.4.26`
GHSA-cchx-mfrc-fwqr Improper authentication in Symfony	High EPSS 1.21%	`>= 2.8.0, < 2.8.50`	`2.8.50`
GHSA-cchx-mfrc-fwqr Improper authentication in Symfony	High EPSS 1.21%	`>= 2.7.0, < 2.7.51`	`2.7.51`
GHSA-cchx-mfrc-fwqr Improper authentication in Symfony	High EPSS 1.21%	`>= 4.0.0, < 4.1.12`	`4.1.12`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor