MediumGHSA-p684-f7fh-jv2jCVE-2015-2309

Symfony has unsafe methods in the Request class

Published 30 May 2024 · Updated 30 May 2024

Affected packages

symfony/http-foundationComposer

Affected: >=2.0.0 <2.3.27
Fixed in: 2.3.27

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.3.27

symfony/http-foundationComposer

Affected: >=2.4.0 <2.5.11
Fixed in: 2.5.11

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.5.11

symfony/http-foundationComposer

Affected: >=2.6.0 <2.6.6
Fixed in: 2.6.6

Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.6.6

symfony/symfonyComposer

Affected: >=2.0.0 <2.3.27
Fixed in: 2.3.27

Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.3.27

symfony/symfonyComposer

Affected: >=2.4.0 <2.5.11
Fixed in: 2.5.11

Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.5.11

symfony/symfonyComposer

Affected: >=2.6.0 <2.6.6
Fixed in: 2.6.6

Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.6.6

Details

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, 2.5.X, and 2.6.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.27, 2.5.11, and 2.6.6. Note that no fixes are provided for Symfony 2.0, 2.1, 2.2, and 2.4 as they are not maintained anymore.

Description

The Symfony\Component\HttpFoundation\Request class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.

The following methods are impacted: getPort(), isSecure(), and getHost(), and getClientIps().

Resolution

All impacted methods now check that the remote address is trusted, which fixes the issue.

The patch for this issue is available here.

Is GHSA-p684-f7fh-jv2j in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/http-foundation, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.