[SECURITY] [DLA 3493-1] symfony security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3493-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
July 11, 2023 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : symfony
Version : 3.4.22+dfsg-2+deb10u2
CVE ID : CVE-2021-21424 CVE-2022-24894 CVE-2022-24895
Multiple security vulnerabilities were found in symfony, a PHP framework
for web and console applications and a set of reusable PHP components,
which could lead to information disclosure or impersonation.
CVE-2021-21424
James Isaac, Mathias Brodala and Laurent Minguet discovered that it
was possible to enumerate users without relevant permissions due to
different exception messages depending on whether the user existed
or not. It was also possible to enumerate users by using a timing
attack, by comparing time elapsed when authenticating an existing
user and authenticating a non-existing user.
403s are now returned whether the user exists or not if a user
cannot switch to a user or if the user does not exist.
CVE-2022-24894
Soner Sayakci discovered that when the Symfony HTTP cache system is
enabled, the response header might be stored with a `Set-Cookie`
header and returned to some other clients, thereby allowing an
attacker to retrieve the victim's session.
The `HttpStore` constructor now takes a parameter containing a list
of private headers that are removed from the HTTP response headers.
The default value for this parameter is `Set-Cookie`, but it can be
overridden or extended by the application.
CVE-2022-24895
Marco Squarcina discovered that CSRF tokens aren't cleared upon
login, which could enable same-site attackers to bypass the CSRF
protection mechanism by performing an attack similar to a
session-fixation.
For Debian 10 buster, these problems have been fixed in version
3.4.22+dfsg-2+deb10u2.
We recommend that you upgrade your symfony packages.
For the detailed security status of symfony please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/symfony
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
A symfony security update has been released for Debian GNU/Linux 10 LTS to address multiple security vulnerabilities.
