| Name | CVE-2018-11408 |
| Description | The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container. NOTE: this issue exists because of an incomplete fix for CVE-2017-16652. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more) |
| References | DLA-1707-1 |
| NVD severity | medium |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| symfony (PTS) | jessie | 2.3.21+dfsg-4+deb8u3 | vulnerable |
| jessie (security) | 2.3.21+dfsg-4+deb8u6 | fixed | |
| stretch | 2.8.7+dfsg-1.3+deb9u2 | fixed | |
| stretch (security) | 2.8.7+dfsg-1.3+deb9u3 | fixed | |
| buster | 3.4.22+dfsg-2 | fixed | |
| buster (security) | 3.4.22+dfsg-2+deb10u1 | fixed | |
| bullseye, sid | 4.3.8+dfsg-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| symfony | source | (unstable) | 3.4.12+dfsg-1 | |||
| symfony | source | jessie | 2.3.21+dfsg-4+deb8u4 | DLA-1707-1 | ||
| symfony | source | stretch | (not affected) |
[stretch] - symfony <not-affected> (Incomplete fix for CVE-2017-16652 wasn't backported)
https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on-security-handlers