CVE-2022-24895

NameCVE-2022-24895
DescriptionSymfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3493-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)buster3.4.22+dfsg-2+deb10u1vulnerable
buster (security)3.4.22+dfsg-2+deb10u3fixed
bullseye4.4.19+dfsg-2+deb11u4fixed
bookworm5.4.23+dfsg-1+deb12u1fixed
sid, trixie6.4.7+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcebuster3.4.22+dfsg-2+deb10u2DLA-3493-1
symfonysourcebullseye4.4.19+dfsg-2+deb11u2
symfonysource(unstable)5.4.20+dfsg-1

Notes

https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m
https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4

Search for package or bug name: Reporting problems