Candidate: CVE-2021-21424
PublicDate: 2021-05-13 16:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21424
 https://symfony.com/blog/cve-2021-21424-prevent-user-enumeration-in-authentication-mechanisms
 https://github.com/symfony/symfony/commit/f012eee6c6034a94566dff596fe4e16dfc5d9c1f
 https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011
 https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68
Description:
 Symfony is a PHP framework for web and console applications and a set of
 reusable PHP components. The ability to enumerate users was possible
 without relevant permissions due to different handling depending on whether
 the user existed or not when attempting to use the switch users
 functionality. We now ensure that 403s are returned whether the user exists
 or not if a user cannot switch to a user or if the user does not exist. The
 patch for this issue is available for branch 3.4.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: low
Discovered-by: James Isaac, Mathias Brodala
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N [5.3 MEDIUM]


Patches_symfony:
upstream_symfony: released (4.4.19+dfsg-2)
precise/esm_symfony: DNE
trusty_symfony: ignored (out of standard support)
trusty/esm_symfony: DNE
xenial_symfony: ignored (out of standard support)
bionic_symfony: needed
focal_symfony: needed
groovy_symfony: ignored (reached end-of-life)
hirsute_symfony: ignored (reached end-of-life)
impish_symfony: not-affected (4.4.19+dfsg-2)
jammy_symfony: not-affected (4.4.19+dfsg-2)
devel_symfony: not-affected (4.4.19+dfsg-2)