Description
Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.38.1.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 packagist | | | 1.38.1 |
packagist | | | 1.38.1 |
 debian 11 | | =1.22.1-1 || =1.23.0-1 || =1.23.1-1 || =1.23.1-2 || =1.24.0-1 || =1.25.0-1 || =1.25.0-2 || =1.25.0-3 || =1.25.0-4 || =1.26.0-1 || =1.26.0-2 || =1.26.0-3 || =1.27.0-1 || =1.27.0-1~new || =1.27.0-2 || =1.28.0-1 || =1.29.0-1 || =1.29.0-2 || =1.29.0-3 || =1.30.0-1 || =1.31.0-1 || =1.31.0-2 || =1.31.0-3 || =1.31.0-4 || =1.31.0-5 || =1.32.0-1 || =1.33.0-1 || =1.33.0-2 || =1.33.0-3 || =1.33.0-4 || =1.33.0-5 || =1.33.0-6 || =1.36.0-1 || =1.37.0-1 || =1.38.1-1 || =1.40.0-1 || =1.40.0-2 || =1.41.0-1 || =1.41.0-2 | - |
debian 12 | | =1.27.0-2 || =1.28.0-1 || =1.29.0-1 || =1.29.0-2 || =1.29.0-3 || =1.30.0-1 || =1.31.0-1 || =1.31.0-2 || =1.31.0-3 || =1.31.0-4 || =1.31.0-5 || =1.32.0-1 || =1.33.0-1 || =1.33.0-2 || =1.33.0-3 || =1.33.0-4 || =1.33.0-5 || =1.33.0-6 || =1.36.0-1 || =1.37.0-1 || =1.38.1-1 || =1.40.0-1 || =1.40.0-2 || =1.41.0-1 || =1.41.0-2 | - |
debian 14 | | =1.1.0-1 || =1.1.1-1 || =1.17.0-1 || =1.17.0-2 || =1.17.1-1 || =1.18.0-1 || =1.18.1-1 || =1.2.0-1 || =1.21.0-1 || =1.21.0-2 || =1.22.0-1 || =1.22.0-1~exp1 || =1.22.0-2 || =1.22.0-3 || =1.22.1-1 || =1.23.0-1 || =1.23.1-1 || =1.23.1-2 || =1.24.0-1 || =1.25.0-1 || =1.25.0-2 || =1.25.0-3 || =1.25.0-4 || =1.26.0-1 || =1.26.0-2 || =1.26.0-3 || =1.27.0-1 || =1.27.0-1~new || =1.27.0-2 || =1.28.0-1 || =1.29.0-1 || =1.29.0-2 || =1.29.0-3 || =1.30.0-1 || =1.31.0-1 || =1.31.0-2 || =1.31.0-3 || =1.31.0-4 || =1.31.0-5 || =1.32.0-1 || =1.33.0-1 || =1.33.0-2 || =1.33.0-3 || =1.33.0-4 || =1.33.0-5 || =1.33.0-6 || =1.36.0-1 || =1.37.0-1 || =1.5.0-1 || =1.6.0-1 || =1.6.0-2 || =1.7.0-1 || =1.8.0-1 || =1.9.0-1 || >=0 <1.38.1-1 | 1.38.1-1 |
