symfony/http-foundation Security Advisories (11)
-
[LOW] CVE-2020-5255: Prevent cache poisoning via a Response Content-Type header
PKSA-t4rz-hp2g-57t1 CVE-2020-5255 GHSA-mcx4-f5f5-4859
Affected version: >=4.4.0,<4.4.7|>=5.0.0,<5.0.7
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser
PKSA-9w98-4rwq-spxr CVE-2019-18888 GHSA-xhh6-956q-4q69
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<2.8.52|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.35|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0|>=4.2.0,<4.2.12|>=4.3.0,<4.3.8
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[CRITICAL] CVE-2019-10913: Reject invalid HTTP method overrides
PKSA-324d-pqmd-hptz CVE-2019-10913 GHSA-x92h-wmg2-6hp7
Affected version: >=2.7.0,<2.7.51|>=2.8.0,<2.8.50|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.26|>=4.0.0,<4.1.0|>=4.1.0,<4.1.12|>=4.2.0,<4.2.7
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] CVE-2018-14773: Remove support for legacy and risky HTTP headers
PKSA-nqj4-v43p-2gxc CVE-2018-14773 GHSA-8wgj-6wx8-h5hq
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.49|>=2.8.0,<2.8.44|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.18|>=3.4.0,<3.4.14|>=4.0.0,<4.0.14|>=4.1.0,<4.1.3
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] CVE-2018-11386: Denial of service when using PDOSessionHandler
PKSA-f8b8-pbjy-s9k8 CVE-2018-11386 GHSA-r2rq-3h56-fqm4
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5.0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Unsafe methods in the Request class
PKSA-md26-zdw9-222r CVE-2015-2309
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.27|>=2.4.0,<2.5.0|>=2.5.0,<2.5.11|>=2.6.0,<2.6.6
Reported by:
FriendsOfPHP/security-advisories -
Security issue when parsing the Authorization header
PKSA-dr6c-z2rf-wh36 CVE-2014-6061
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.19|>=2.4.0,<2.4.9|>=2.5.0,<2.5.4
Reported by:
FriendsOfPHP/security-advisories -
Denial of service with a malicious HTTP Host header
PKSA-rhzp-d9k8-shyq CVE-2014-5244
Affected version: >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.3.19|>=2.4.0,<2.4.9|>=2.5.0,<2.5.4
Reported by:
FriendsOfPHP/security-advisories -
[MEDIUM] Request::getHost() poisoning
PKSA-tf6z-kynr-311v CVE-2013-4752 GHSA-22pv-7v9j-hqxp
Affected version: >=2.0.0,<2.0.24|>=2.1.0,<2.1.12|>=2.2.0,<2.2.5|>=2.3.0,<2.3.3
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Request::getClientIp() when the trust proxy mode is enabled
Affected version: >=2.0.0,<2.0.19|>=2.1.0,<2.1.4
Reported by:
FriendsOfPHP/security-advisories -
[MEDIUM] Routes behind a firewall are accessible even when not logged in
PKSA-msdq-r83n-tdy4 CVE-2012-6431 GHSA-83c3-qx27-2rwr
Affected version: >=2.0.0,<2.0.19
Reported by:
GitHub, FriendsOfPHP/security-advisories