HighGHSA-v77v-x634-9m56CVE-2014-5244

Symfony vulnerable to denial of service via a malicious HTTP Host header

Published 30 May 2024 · Updated 30 May 2024

Affected packages

symfony/http-foundationComposer
Affected
>=2.0.0 <2.3.19
Fixed in
2.3.19
Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.3.19
symfony/http-foundationComposer
Affected
>=2.4.0 <2.4.9
Fixed in
2.4.9
Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.4.9
symfony/http-foundationComposer
Affected
>=2.5.0 <2.5.4
Fixed in
2.5.4
Update to the fixed version for your release line, for example:composer require symfony/http-foundation:^2.5.4
symfony/symfonyComposer
Affected
>=2.0.0 <2.3.19
Fixed in
2.3.19
Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.3.19
symfony/symfonyComposer
Affected
>=2.4.0 <2.4.9
Fixed in
2.4.9
Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.4.9
symfony/symfonyComposer
Affected
>=2.5.0 <2.5.4
Fixed in
2.5.4
Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.5.4

Details

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description When an arbitrarily long hostname is sent by a client, its parsing in Request::getHost() can lead to a DoS attack, due to the way we validate the hostname via a regular expression.

Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submitted value length.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11828

Is GHSA-v77v-x634-9m56 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/http-foundation, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.