Fluid Attacks Database

Description

Symfony Open Redirect The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	symfony/symfony	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.3.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
packagist	symfony/security-bundle	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.3.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
debian 12	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 11	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 13	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 14	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1

Aliases

1. CVE-2018-114082. NVD-2018-114083. OSV-2018-114084. OSV-DEBIAN-2018-114085. GCVE-2018-114086. lists.debian.org7. SECURITY-TRACKER-CVE-2018-11408

References

1. https://github.com/symfony/symfony/commit/b20e83562e32c56f8d9b8296ab07b0e4c0a54db82. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11408.yaml3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11408.yaml4. https://lists.fedoraproject.org/archives/list/[email protected]/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV5. https://lists.fedoraproject.org/archives/list/[email protected]/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW6. https://lists.fedoraproject.org/archives/list/[email protected]/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH7. https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers8. https://symfony.com/cve-2018-11408