CVE-2020-5275

NameCVE-2020-5275
DescriptionIn symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs961415

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)jessie2.3.21+dfsg-4+deb8u3fixed
jessie (security)2.3.21+dfsg-4+deb8u6fixed
stretch (security), stretch2.8.7+dfsg-1.3+deb9u3fixed
buster, buster (security)3.4.22+dfsg-2+deb10u1fixed
bullseye, sid4.4.8-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysource(unstable)4.4.8-1961415
symfonysourcebuster(not affected)
symfonysourcejessie(not affected)
symfonysourcestretch(not affected)

Notes

[buster] - symfony <not-affected> (Introduced in 4.4.0)
[stretch] - symfony <not-affected> (Introduced in 4.4.0)
[jessie] - symfony <not-affected> (Introduced in 4.4.0)
https://symfony.com/blog/cve-2020-5275-all-access-control-rules-are-required-when-a-firewall-uses-the-unanimous-strategy
https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf

Search for package or bug name: Reporting problems