CVE-2018-14773

Name	CVE-2018-14773
Description	An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1707-1, DSA-4441-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
symfony (PTS)	jessie, jessie (lts)	2.3.21+dfsg-4+deb8u6	fixed
	stretch (security)	2.8.7+dfsg-1.3+deb9u3	fixed
	stretch (lts), stretch	2.8.7+dfsg-1.3+deb9u5	fixed
	buster (security), buster, buster (lts)	3.4.22+dfsg-2+deb10u3	fixed
	bullseye	4.4.19+dfsg-2+deb11u6	fixed
	bookworm	5.4.23+dfsg-1+deb12u2	fixed
	bookworm (security)	5.4.23+dfsg-1+deb12u4	fixed
	sid, trixie	6.4.15+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
symfony	source	jessie	2.3.21+dfsg-4+deb8u4	DLA-1707-1
symfony	source	stretch	2.8.7+dfsg-1.3+deb9u2	DSA-4441-1
symfony	source	(unstable)	3.4.14+dfsg-1

https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers