Em resumo
- CVE-2024-50343 é uma vulnerabilidade BAIXO (CVSS 3.1) que afeta symfony/symfony, symfony/validator.
- Chance de exploração nos próximos 30 dias (EPSS): 0.46%, maior que 39.5% das vulnerabilidades.
- Correção: atualize para 6.4.11, 7.1.4, 5.4.43 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| symfony/symfony Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
| symfony/validator Packagist | ≥ 6.0.0, < 6.4.11≥ 7.0.0, < 7.1.4< 5.4.43
| 6.4.117.1.45.4.43
|
Description
Description
It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.
Resolution
Symfony now uses the D regex modifier to match the entire input.
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.
NVD description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Mais vulnerabilidades de symfony/symfony
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free