Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 packagist | | >=6.4.0 <6.4.41 || >=7.0.0 <7.4.13 || >=8.0.0 <8.0.13 | 6.4.41, 7.4.13, 8.0.13 |
packagist | | >=5.4.0 <5.4.53 || >=6.4.0 <6.4.41 || >=7.0.0 <7.4.13 || >=8.0.0 <8.0.13 | 5.4.53, 6.4.41, 7.4.13, 8.0.13 |
packagist | | | 5.4.53 |
 debian 12 | | =5.4.23+dfsg-1 || =5.4.23+dfsg-1+deb12u1 || =5.4.23+dfsg-1+deb12u2 || =5.4.23+dfsg-1+deb12u3 || =5.4.23+dfsg-1+deb12u4 || =5.4.23+dfsg-1+deb12u5 || =5.4.24+dfsg-1 || =5.4.25+dfsg-1 || =5.4.27+dfsg-1 || =5.4.28+dfsg-1 || =5.4.29+dfsg-1 || =5.4.30+dfsg-1 || =5.4.31+dfsg-1 || =5.4.31+dfsg-2 || =5.4.32+dfsg-1 || =5.4.33+dfsg-1 || =5.4.34+dfsg-1 || =5.4.34+dfsg-2 || =5.4.35+dfsg-1 || =5.4.35+dfsg-2 || =5.4.35+dfsg-3 || =5.4.52+dfsg-0+deb12u1 || >=0 <5.4.53+dfsg-0+deb12u1 | 5.4.53+dfsg-0+deb12u1 |
debian 13 | | =6.4.21+dfsg-2 || =6.4.21+dfsg-2+deb13u1 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =6.4.40+dfsg-0+deb13u1 || >=0 <6.4.41+dfsg-0+deb13u1 | 6.4.41+dfsg-0+deb13u1 |
debian 14 | | =6.4.21+dfsg-2 || =6.4.24+dfsg-1 || =6.4.25+dfsg-1 || =7.0.4+dfsg-1 || =7.0.5+dfsg-1 || =7.0.6+dfsg-1 || =7.0.7+dfsg-1 || =7.1.0~beta1+dfsg-1 || =7.1.0~rc1+dfsg-1 || =7.1.2+dfsg-1 || =7.1.3+dfsg-1 || =7.1.4+dfsg-1 || =7.1.5+dfsg-1 || =7.2.0~beta1+dfsg-1 || =7.2.0~beta2+dfsg-1 || =7.2.0~rc1+dfsg-1 || =7.2.1+dfsg-1 || =7.2.2+dfsg-1 || =7.2.3+dfsg-1 || =7.2.4+dfsg-1 || =7.2.5+dfsg-1 || =7.2.6-1 || =7.3.0+dfsg-1 || =7.3.0~beta1+dfsg-1 || =7.3.0~beta2+dfsg-1 || =7.3.0~rc1+dfsg-1 || =7.3.1+dfsg-1 || =7.3.2+dfsg-1 || =7.3.3+dfsg-1 || =7.3.4+dfsg-1 || =7.3.5-1 || =7.4.0+dfsg-1 || =7.4.0+dfsg-2 || =7.4.0~beta1-1 || =7.4.0~beta1-2 || =7.4.0~beta2+dfsg-1 || =7.4.0~beta2+dfsg-2 || =7.4.0~beta2+dfsg-3 || =7.4.0~rc1+dfsg-1 || =7.4.0~rc2+dfsg-1 || =7.4.0~rc3+dfsg-1 || =7.4.10+dfsg-1 || =7.4.12+dfsg-1 || =7.4.2+dfsg-1 || =7.4.2+dfsg-2 || =7.4.3+dfsg-1 || =7.4.4+dfsg-1 || =7.4.5+dfsg-1 || =7.4.6+dfsg-1 || =7.4.6+dfsg-2 || =7.4.7+dfsg-1 || =7.4.8+dfsg-1 || =7.4.9+dfsg-1 || >=0 <7.4.13+dfsg-1 | 7.4.13+dfsg-1 |
