symfony/security-http (Packagist)
Advisories
57
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.0.13 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require symfony/security-http:^8.0.13Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes |
High EPSS 0.60% |
>= 6.0.0, < 6.4.41 | 6.4.41 |
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes |
High EPSS 0.60% |
>= 7.0.0, < 7.4.13 | 7.4.13 |
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes |
High EPSS 0.60% |
>= 8.0.0, < 8.0.13 | 8.0.13 |
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes |
High EPSS 0.60% |
< 5.4.53 | 5.4.53 |
| GHSA-6439-2f28-8p8q Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
High EPSS 0.43% |
>= 7.4.0, < 7.4.12 | 7.4.12 |
| GHSA-6439-2f28-8p8q Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] |
High EPSS 0.43% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-j8gj-9rm5-4xhx Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay |
High EPSS 0.49% |
>= 7.1.0, < 7.4.12 | 7.4.12 |
| GHSA-j8gj-9rm5-4xhx Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay |
High EPSS 0.49% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-29fc-p6c4-24cg Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims |
Critical EPSS 0.26% |
>= 8.0.0, < 8.0.12 | 8.0.12 |
| GHSA-29fc-p6c4-24cg Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims |
Critical EPSS 0.26% |
>= 7.4.0, < 7.4.12 | 7.4.12 |
| GHSA-29fc-p6c4-24cg Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims |
Critical EPSS 0.26% |
>= 6.3.0, < 6.4.40 | 6.4.40 |
| GHSA-ph86-p8f6-f9r2 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator |
Critical EPSS 0.37% |
>= 8.0.0-BETA1, < 8.0.12 | 8.0.12 |
| GHSA-ph86-p8f6-f9r2 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator |
Critical EPSS 0.37% |
< 5.4.52 | 5.4.52 |
| GHSA-ph86-p8f6-f9r2 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator |
Critical EPSS 0.37% |
>= 6.0.0-BETA1, < 6.4.40 | 6.4.40 |
| GHSA-ph86-p8f6-f9r2 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator |
Critical EPSS 0.37% |
>= 7.0.0-BETA1, < 7.4.12 | 7.4.12 |
| GHSA-m2wj-r6g3-fxfx Symfony possible session fixation vulnerability |
Medium EPSS 0.69% |
>= 5.4.21, < 5.4.31 | 5.4.31 |
| GHSA-m2wj-r6g3-fxfx Symfony possible session fixation vulnerability |
Medium EPSS 0.69% |
>= 6.2.7, < 6.3.8 | 6.3.8 |
| GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames |
High EPSS 1.86% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames |
High EPSS 1.86% |
>= 2.8.0, < 2.8.6 | 2.8.6 |
| GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames |
High EPSS 1.86% |
>= 2.4.0, < 2.7.13 | 2.7.13 |
| GHSA-whgv-8cg3-7hcm Symphony Denial of Service Via Overlong Usernames |
High EPSS 1.86% |
>= 2.3.0, < 2.3.41 | 2.3.41 |
| GHSA-g97c-jfx6-xvxh Symfony Vulnerable to Timing Attack |
High EPSS 2.54% |
>= 2.4.0, < 2.6.12 | 2.6.12 |
| GHSA-g97c-jfx6-xvxh Symfony Vulnerable to Timing Attack |
High EPSS 2.54% |
>= 2.7.0, < 2.7.7 | 2.7.7 |
| GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability |
Low EPSS 2.71% |
>= 2.7.0, < 2.7.7 | 2.7.7 |
| GHSA-j5jh-hpr4-h332 Symfony Session Fixation Vulnerability |
Low EPSS 2.71% |
>= 2.4.0, < 2.6.12 | 2.6.12 |
| GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability |
High EPSS 1.97% |
>= 3.0.0, < 3.3.17 | 3.3.17 |
| GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability |
High EPSS 1.97% |
>= 4.0.0, < 4.0.11 | 4.0.11 |
| GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability |
High EPSS 1.97% |
>= 3.4.0, < 3.4.11 | 3.4.11 |
| GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability |
High EPSS 1.97% |
>= 2.7.0, < 2.7.48 | 2.7.48 |
| GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability |
High EPSS 1.97% |
>= 2.8.0, < 2.8.41 | 2.8.41 |
| GHSA-r7p7-qr7p-2rrf Symfony Open Redirect |
Medium EPSS 0.77% |
>= 2.8.0, < 2.8.31 | 2.8.31 |
| GHSA-r7p7-qr7p-2rrf Symfony Open Redirect |
Medium EPSS 0.77% |
>= 2.7.0, < 2.7.38 | 2.7.38 |
| GHSA-r7p7-qr7p-2rrf Symfony Open Redirect |
Medium EPSS 0.77% |
>= 3.2.0, < 3.2.14 | 3.2.14 |
| GHSA-r7p7-qr7p-2rrf Symfony Open Redirect |
Medium EPSS 0.77% |
>= 3.3.0, < 3.3.13 | 3.3.13 |
| GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation |
High EPSS 0.75% |
>= 2.7.0, < 2.7.48 | 2.7.48 |
| GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation |
High EPSS 0.75% |
>= 4.0.0, < 4.0.11 | 4.0.11 |
| GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation |
High EPSS 0.75% |
>= 2.8.0, < 2.8.41 | 2.8.41 |
| GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation |
High EPSS 0.75% |
>= 3.0.0, < 3.3.17 | 3.3.17 |
| GHSA-g4g7-q726-v5hg Symfony CSRF Token Fixation |
High EPSS 0.75% |
>= 3.4.0, < 3.4.11 | 3.4.11 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 4.1.0, < 4.1.9 | 4.1.9 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 4.0.0, < 4.0.15 | 4.0.15 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 3.0.0, < 3.4.20 | 3.4.20 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 2.8.0, < 2.8.49 | 2.8.49 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 2.7.38, < 2.7.50 | 2.7.50 |
| GHSA-89r2-5g34-2g47 Symfony Open Redirect |
Medium EPSS 1.49% |
>= 4.2.0, < 4.2.1 | 4.2.1 |
| GHSA-rfcf-m67m-jcrq Authentication granted to all firewalls instead of just one |
Medium EPSS 1.39% |
>= 5.3.0, < 5.3.2 | 5.3.2 |
| GHSA-g2qj-pmxm-9f8f User enumeration in authentication mechanisms |
Low | >= 5.1.0, < 5.2.8 | 5.2.8 |
| GHSA-5pv8-ppvj-4h68 Prevent user enumeration using Guard or the new Authenticator-based Security |
Medium EPSS 1.64% |
>= 5.1.0, < 5.2.8 | 5.2.8 |
| GHSA-g4m9-5hpf-hx72 Firewall configured with unanimous strategy was not actually unanimous in Symfony |
High EPSS 1.15% |
>= 5.0.0, < 5.0.7 | 5.0.7 |
| GHSA-g4m9-5hpf-hx72 Firewall configured with unanimous strategy was not actually unanimous in Symfony |
High EPSS 1.15% |
>= 4.4.0, < 4.4.7 | 4.4.7 |
| GHSA-cchx-mfrc-fwqr Improper authentication in Symfony |
High EPSS 1.21% |
>= 4.2.0, < 4.2.7 | 4.2.7 |
| GHSA-cchx-mfrc-fwqr Improper authentication in Symfony |
High EPSS 1.21% |
>= 4.0.0, < 4.1.12 | 4.1.12 |
| GHSA-cchx-mfrc-fwqr Improper authentication in Symfony |
High EPSS 1.21% |
>= 3.0.0, < 3.4.26 | 3.4.26 |
| GHSA-cchx-mfrc-fwqr Improper authentication in Symfony |
High EPSS 1.21% |
>= 2.8.0, < 2.8.50 | 2.8.50 |
| GHSA-cchx-mfrc-fwqr Improper authentication in Symfony |
High EPSS 1.21% |
>= 2.7.0, < 2.7.51 | 2.7.51 |
| GHSA-4vpc-5jx4-cfqg User enumeration leak using switch user functionality in Symfony |
Medium EPSS 1.55% |
>= 4.1.0, < 4.2.12 | 4.2.12 |
| GHSA-4vpc-5jx4-cfqg User enumeration leak using switch user functionality in Symfony |
Medium EPSS 1.55% |
>= 4.3.0, < 4.3.8 | 4.3.8 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor