CVE-2024-50341

NameCVE-2024-50341
Descriptionsymfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)jessie, jessie (lts)2.3.21+dfsg-4+deb8u6vulnerable
stretch (security)2.8.7+dfsg-1.3+deb9u3vulnerable
stretch (lts), stretch2.8.7+dfsg-1.3+deb9u5vulnerable
buster (security), buster, buster (lts)3.4.22+dfsg-2+deb10u3vulnerable
bullseye4.4.19+dfsg-2+deb11u6fixed
bookworm5.4.23+dfsg-1+deb12u2fixed
bookworm (security)5.4.23+dfsg-1+deb12u4fixed
sid, trixie6.4.16+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcebullseye(not affected)
symfonysourcebookworm(not affected)
symfonysource(unstable)6.4.10+dfsg-1

Notes

[bookworm] - symfony <not-affected> (Vulnerable code not present, introduced in 6.2)
[bullseye] - symfony <not-affected> (Vulnerable code not present, introduced in 6.2)
https://github.com/symfony/symfony/security/advisories/GHSA-jxgr-3v7q-3w9v
Fixed by: https://github.com/symfony/symfony/commit/22a0789a0085c3ee96f4ef715ecad8255cf0e105 (v6.4.10, v7.0.10, v7.1.3)

Search for package or bug name: Reporting problems