| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/error-handler | ≥ 4.4.0, < 4.4.4≥ 5.0.0, < 5.0.4 | 4.4.45.0.4 |
| symfony/symfony | ≥ 4.4.0, < 4.4.4≥ 5.0.0, < 5.0.4 | 4.4.45.0.4 |
| symfony | ≥ 4.4.0, < 4.4.4≥ 5.0.0, < 5.0.4 | 4.4.45.0.4 |
When ErrorHandler renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-debug environments.
The ErrorHandler class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-debug environments.
The patches for this issue are available here and here for branch 4.4.
I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free