Kurz gesagt
- CVE-2024-50343 ist eine Schwachstelle (NIEDRIG (CVSS 3.1)) in symfony/symfony, symfony/validator.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.46%, höher als bei 39.5% aller Schwachstellen.
- Abhilfe: auf 6.4.11, 7.1.4, 5.4.43 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| symfony/symfony Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
| symfony/validator Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
Description
Description
It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.
Resolution
Symfony now uses the D regex modifier to match the entire input.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
NVD description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free