In breve
- CVE-2024-50343 è una vulnerabilità BASSO (CVSS 3.1) che riguarda symfony/symfony, symfony/validator.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.46%, superiore al 39.5% delle vulnerabilità.
- Correzione: aggiornare a 6.4.11, 7.1.4, 5.4.43 o successiva.
| Package | Affected versions | Patched versions |
|---|
| symfony/symfony Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
| symfony/validator Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
Description
Description
It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.
Resolution
Symfony now uses the D regex modifier to match the entire input.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
NVD description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free