CVE-2022-24895

Name	CVE-2022-24895
Description	Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3493-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
symfony (PTS)	buster	3.4.22+dfsg-2+deb10u1	vulnerable
	buster (security)	3.4.22+dfsg-2+deb10u3	fixed
	bullseye	4.4.19+dfsg-2+deb11u4	fixed
	bookworm	5.4.23+dfsg-1+deb12u1	fixed
	sid, trixie	6.4.6+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
symfony	source	buster	3.4.22+dfsg-2+deb10u2	DLA-3493-1
symfony	source	bullseye	4.4.19+dfsg-2+deb11u2
symfony	source	(unstable)	5.4.20+dfsg-1

Notes

https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m
https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4