In short
- CVE-2024-50343 is a LOW (CVSS 3.1) vulnerability affecting symfony/symfony, symfony/validator.
- Chance of exploitation in the next 30 days (EPSS): 0.46%, higher than 39.5% of all vulnerabilities.
- Fix: update to 6.4.11, 7.1.4, 5.4.43 or later.
| Package | Affected versions | Patched versions |
|---|
| symfony/symfony Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
| symfony/validator Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
Description
Description
It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.
Resolution
Symfony now uses the D regex modifier to match the entire input.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
NVD description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
More vulnerabilities in symfony/symfony
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free