En bref
- CVE-2024-50343 est une vulnérabilité FAIBLE (CVSS 3.1) touchant symfony/symfony, symfony/validator.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.46%, plus élevée que 39.5% des vulnérabilités.
- Correctif : mettre à jour vers 6.4.11, 7.1.4, 5.4.43 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| symfony/symfony Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
| symfony/validator Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
Description
Description
It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.
Resolution
Symfony now uses the D regex modifier to match the entire input.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
NVD description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free