Symfony Multiple Security Vulnerabilities

Bugtraq ID:	108414
Class:	Unknown
CVE:	CVE-2019-10909 CVE-2019-10910 CVE-2019-10911
Remote:	Yes
Local:	No
Published:	Apr 17 2019 12:00AM
Updated:	Apr 17 2019 12:00AM
Credit:	Christophe Coevoet (stof), Nicolas Grekas, Jon Cave, Michael Cullum.
Vulnerable:	SensioLabs Symfony 4.2.6 SensioLabs Symfony 4.2.1 SensioLabs Symfony 4.2 SensioLabs Symfony 4.1.11 SensioLabs Symfony 4.1.9 SensioLabs Symfony 4.1.8 SensioLabs Symfony 4.1.3 SensioLabs Symfony 4.1.2 SensioLabs Symfony 4.1 SensioLabs Symfony 3.4.25 SensioLabs Symfony 3.4.20 SensioLabs Symfony 3.4.19 SensioLabs Symfony 3.4.14 SensioLabs Symfony 3.4.13 SensioLabs Symfony 3.4 SensioLabs Symfony 2.8.49 SensioLabs Symfony 2.8.48 SensioLabs Symfony 2.8.44 SensioLabs Symfony 2.8.43 SensioLabs Symfony 2.8 SensioLabs Symfony 2.7.50 SensioLabs Symfony 2.7.49 SensioLabs Symfony 2.7.48 SensioLabs Symfony 2.7.7 SensioLabs Symfony 2.7.6 SensioLabs Symfony 2.7.5 SensioLabs Symfony 2.7.4 SensioLabs Symfony 2.7.3 SensioLabs Symfony 2.7.2 SensioLabs Symfony 2.7.1 SensioLabs Symfony 2.7 Drupal Drupal 8.6.14 Drupal Drupal 8.6.13 Drupal Drupal 8.6.12 Drupal Drupal 8.6.11 Drupal Drupal 8.6.10 Drupal Drupal 8.6.9 Drupal Drupal 8.6.8 Drupal Drupal 8.6.7 Drupal Drupal 8.6.6 Drupal Drupal 8.6.5 Drupal Drupal 8.6.4 Drupal Drupal 8.6.3 Drupal Drupal 8.6.2 Drupal Drupal 8.6.1 Drupal Drupal 8.5.14 Drupal Drupal 8.5.13 Drupal Drupal 8.5.12 Drupal Drupal 8.5.11 Drupal Drupal 8.5.10 Drupal Drupal 8.5.9 Drupal Drupal 8.5.8 Drupal Drupal 8.5.7 Drupal Drupal 8.5.6 Drupal Drupal 8.5.5 Drupal Drupal 8.5.4 Drupal Drupal 8.5.3 Drupal Drupal 8.5.2 Drupal Drupal 8.5.1 Drupal Drupal 8.6 Drupal Drupal 8.5
Not Vulnerable:	SensioLabs Symfony 4.2.7 SensioLabs Symfony 3.4.26 SensioLabs Symfony 2.8.50 SensioLabs Symfony 2.7.51 Drupal Drupal 8.6.15 Drupal Drupal 8.5.15

Symfony Multiple Security Vulnerabilities

Symfony is prone to the following multiple security vulnerabilities:

1. A cross-site scripting vulnerability
2. An arbitrary code-execution vulnerability
3. A security vulnerability

An attacker may leverage these issues to bypass certain security restrictions, perform certain unauthorized actions actions, execute arbitrary code and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

Symfony versions 2.7.0 through 2.7.50, 2.8.0 through 2.8.49, 3.4.0 through 3.4.25, 4.1.0 through 4.1.11 and 4.2.0 through 4.2.6 are vulnerable.

Symfony Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Symfony Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symfony Multiple Security Vulnerabilities

References:

• [DI] Check service IDs are valid (Github)
  
• [Security] Add a separator in the remember me cookie hash (Github)
  
• Fix XSS issues in the form theme of the PHP templating engine (Github)
  
• Symfony Home Page (Symfony)
  
• CVE-2019-10909: Escape validation messages in the PHP templating engine (Symfony)
  
• CVE-2019-10910: Check service IDs are valid (Symfony)
  
• CVE-2019-10911: Add a separator in the remember me cookie hash (Symfony)
  
• Drupal core - Moderately critical - Multiple Vulnerabilities - SA-CORE-2019-005 (Drupal)