CVE-2018-11408
Published: 13 June 2018
The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.
Priority
Status
Package | Release | Status |
---|---|---|
symfony Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
bionic |
Needed
|
|
cosmic |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
disco |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
eoan |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
focal |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
groovy |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
hirsute |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
impish |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
jammy |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
kinetic |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
lunar |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
mantic |
Not vulnerable
(3.4.15+dfsg-2ubuntu4)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.4.12+dfsg-1)
|
|
xenial |
Needed
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.1 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Changed |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
- https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
- https://www.cve.org/CVERecord?id=CVE-2018-11408
- NVD
- Launchpad
- Debian