CVE-2018-11408

NameCVE-2018-11408
DescriptionThe security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)jessie (security), jessie2.3.21+dfsg-4+deb8u3vulnerable
stretch2.8.7+dfsg-1.3fixed
buster, sid3.4.6+dfsg-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysource(unstable)(unfixed)
symfonysourcestretch(not affected)

Notes

[stretch] - symfony <not-affected> (Incomplete fix for CVE-2017-16652 wasn't backported)
https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers

Search for package or bug name: Reporting problems