HighGHSA-cchx-mfrc-fwqrCVE-2019-10911
Improper authentication in Symfony
Published 12 Feb 2020 · Updated 16 Feb 2024
Affected packages
symfony/security-httpComposer
- Affected
- >=2.7.0 <2.7.51
- Fixed in
- 2.7.51
Update to the fixed version for your release line, for example:
composer require symfony/security-http:^2.7.51symfony/security-httpComposer
- Affected
- >=2.8.0 <2.8.50
- Fixed in
- 2.8.50
Update to the fixed version for your release line, for example:
composer require symfony/security-http:^2.8.50symfony/security-httpComposer
- Affected
- >=3.0.0 <3.4.26
- Fixed in
- 3.4.26
Update to the fixed version for your release line, for example:
composer require symfony/security-http:^3.4.26symfony/security-httpComposer
- Affected
- >=4.0.0 <4.1.12
- Fixed in
- 4.1.12
Update to the fixed version for your release line, for example:
composer require symfony/security-http:^4.1.12symfony/security-httpComposer
- Affected
- >=4.2.0 <4.2.7
- Fixed in
- 4.2.7
Update to the fixed version for your release line, for example:
composer require symfony/security-http:^4.2.7symfony/securityComposer
- Affected
- >=2.7.0 <2.7.51
- Fixed in
- 2.7.51
Update to the fixed version for your release line, for example:
composer require symfony/security:^2.7.51symfony/securityComposer
- Affected
- >=2.8.0 <2.8.50
- Fixed in
- 2.8.50
Update to the fixed version for your release line, for example:
composer require symfony/security:^2.8.50symfony/securityComposer
- Affected
- >=3.0.0 <3.4.26
- Fixed in
- 3.4.26
Update to the fixed version for your release line, for example:
composer require symfony/security:^3.4.26symfony/securityComposer
- Affected
- >=4.0.0 <4.1.12
- Fixed in
- 4.1.12
Update to the fixed version for your release line, for example:
composer require symfony/security:^4.1.12symfony/securityComposer
- Affected
- >=4.2.0 <4.2.7
- Fixed in
- 4.2.7
Update to the fixed version for your release line, for example:
composer require symfony/security:^4.2.7symfony/symfonyComposer
- Affected
- >=2.7.0 <2.7.51
- Fixed in
- 2.7.51
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.7.51symfony/symfonyComposer
- Affected
- >=2.8.0 <2.8.50
- Fixed in
- 2.8.50
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^2.8.50symfony/symfonyComposer
- Affected
- >=3.0.0 <3.4.26
- Fixed in
- 3.4.26
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^3.4.26symfony/symfonyComposer
- Affected
- >=4.0.0 <4.1.12
- Fixed in
- 4.1.12
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^4.1.12symfony/symfonyComposer
- Affected
- >=4.2.0 <4.2.7
- Fixed in
- 4.2.7
Update to the fixed version for your release line, for example:
composer require symfony/symfony:^4.2.7Details
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Is GHSA-cchx-mfrc-fwqr in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/security-http, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-10911
- Linkgithub.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml
- Linkgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml
- Linkgithub.com/symfony/symfony
- Linksymfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
- Linksymfony.com/cve-2019-10911
- Linkwww.synology.com/security/advisory/Synology_SA_19_19
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.