CVE-2020-15094

NameCVE-2020-15094
DescriptionIn Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)stretch (security), stretch2.8.7+dfsg-1.3+deb9u3fixed
buster, buster (security)3.4.22+dfsg-2+deb10u1fixed
bullseye, sid4.4.19+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcestretch(not affected)
symfonysourcebuster(not affected)
symfonysource(unstable)4.4.13+dfsg-1

Notes

[buster] - symfony <not-affected> (Vulnerable code introduced later - in v4.4.0)
[stretch] - symfony <not-affected> (Vulnerable code introduced later - in v4.4.0)
https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r
https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78

Search for package or bug name: Reporting problems