CVE-2020-5274
Summary
| CVE | CVE-2020-5274 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-03-30 20:15:00 UTC |
|---|
| Updated | 2020-04-01 20:34:00 UTC |
|---|
| Description | In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5 |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Added debug argument to decide if debug page should be shown or not · symfony/symfony@cf80224 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Escape variable in Exception Template · symfony/symfony@629d21b · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Fix Exception message escaping rendered by ErrorHandler · Advisory · symfony/symfony · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 180714 Debian Security Update for symfony (CVE-2020-5274)
