GHSA-7hwc-2cq4-6x2w: Symfony Open Redirect

Affected packages

symfony/symfonyComposer

Affected: >=2.7.0 <2.7.48
Fixed in: 2.7.48

Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.7.48

symfony/symfonyComposer

Affected: >=2.8.0 <2.8.41
Fixed in: 2.8.41

Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.8.41

symfony/symfonyComposer

Affected: >=3.3.0 <3.3.17
Fixed in: 3.3.17

Update to the fixed version for your release line, for example:composer require symfony/symfony:^3.3.17

symfony/symfonyComposer

Affected: >=3.4.0 <3.4.11
Fixed in: 3.4.11

Update to the fixed version for your release line, for example:composer require symfony/symfony:^3.4.11

symfony/symfonyComposer

Affected: >=4.0.0 <4.0.11
Fixed in: 4.0.11

Update to the fixed version for your release line, for example:composer require symfony/symfony:^4.0.11

symfony/security-bundleComposer

Affected: >=2.7.0 <2.7.48
Fixed in: 2.7.48

Update to the fixed version for your release line, for example:composer require symfony/security-bundle:^2.7.48

symfony/security-bundleComposer

Affected: >=2.8.0 <2.8.41
Fixed in: 2.8.41

Update to the fixed version for your release line, for example:composer require symfony/security-bundle:^2.8.41

symfony/security-bundleComposer

Affected: >=3.3.0 <3.3.17
Fixed in: 3.3.17

Update to the fixed version for your release line, for example:composer require symfony/security-bundle:^3.3.17

symfony/security-bundleComposer

Affected: >=3.4.0 <3.4.11
Fixed in: 3.4.11

Update to the fixed version for your release line, for example:composer require symfony/security-bundle:^3.4.11

symfony/security-bundleComposer

Affected: >=4.0.0 <4.0.11
Fixed in: 4.0.11

Update to the fixed version for your release line, for example:composer require symfony/security-bundle:^4.0.11

Details

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

Is GHSA-7hwc-2cq4-6x2w in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/symfony, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

Symfony Open Redirect

Affected packages

Details

Is GHSA-7hwc-2cq4-6x2w in any of your client repos?

References