CVE-2018-11408

Name	CVE-2018-11408
Description	The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1707-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
symfony (PTS)	bullseye	4.4.19+dfsg-2+deb11u6	fixed
	bullseye (security)	4.4.19+dfsg-2+deb11u7	fixed
	bookworm, bookworm (security)	5.4.23+dfsg-1+deb12u4	fixed
	trixie	6.4.21+dfsg-2	fixed
	forky, sid	6.4.24+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
symfony	source	jessie	2.3.21+dfsg-4+deb8u4	DLA-1707-1
symfony	source	stretch	(not affected)
symfony	source	(unstable)	3.4.12+dfsg-1

Notes

[stretch] - symfony <not-affected> (Incomplete fix for CVE-2017-16652 wasn't backported)
https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers