CVE-2023-46734

NameCVE-2023-46734
DescriptionSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3664-1
Debian Bugs1055774

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)buster3.4.22+dfsg-2+deb10u1vulnerable
buster (security)3.4.22+dfsg-2+deb10u3fixed
bullseye4.4.19+dfsg-2+deb11u3vulnerable
bookworm5.4.23+dfsg-1vulnerable
sid, trixie5.4.31+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcebuster3.4.22+dfsg-2+deb10u3DLA-3664-1
symfonysource(unstable)5.4.31+dfsg-11055774

Notes

[bookworm] - symfony <no-dsa> (Minor issue)
[bullseye] - symfony <no-dsa> (Minor issue)
https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3
https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c (v4.4.51, v5.4.31, v6.3.8)

Search for package or bug name: Reporting problems