Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

symfony: CVE-2023-46734

Related Vulnerabilities: CVE-2023-46734  

Source

Debian Bug report logs - #1055774
symfony: CVE-2023-46734

version graph

Package: src:symfony; Maintainer for src:symfony is Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>;

Reported by: Salvatore Bonaccorso <carnil@debian.org>

Date: Sat, 11 Nov 2023 07:57:01 UTC

Severity: important

Tags: pending, security, upstream

Found in versions symfony/4.4.19+dfsg-2, symfony/3.4.22+dfsg-2, symfony/5.4.30+dfsg-1, symfony/5.4.23+dfsg-1, symfony/3.4.22+dfsg-2+deb10u2, symfony/5.4.29+dfsg-1, symfony/4.4.19+dfsg-2+deb11u3

Reply or subscribe to this bug.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>:
Bug#1055774; Package src:symfony. (Sat, 11 Nov 2023 07:57:03 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>. (Sat, 11 Nov 2023 07:57:03 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: symfony: CVE-2023-46734
Date: Sat, 11 Nov 2023 08:54:33 +0100
Source: symfony
Version: 5.4.30+dfsg-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 5.4.29+dfsg-1
Control: found -1 5.4.23+dfsg-1
Control: found -1 4.4.19+dfsg-2+deb11u3
Control: found -1 4.4.19+dfsg-2
Control: found -1 3.4.22+dfsg-2+deb10u2
Control: found -1 3.4.22+dfsg-2

Hi,

The following vulnerability was published for symfony.

CVE-2023-46734[0]:
| Symfony is a PHP framework for web and console applications and a
| set of reusable PHP components. Starting in versions 2.0.0, 5.0.0,
| and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig
| filters in CodeExtension use `is_safe=html` but don't actually
| ensure their input is safe. As of versions 4.4.51, 5.4.31, and
| 6.3.8, Symfony now escapes the output of the affected filters.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-46734
    https://www.cve.org/CVERecord?id=CVE-2023-46734
[1] https://github.com/symfony/symfony/security/advisories/GHSA-q847-2q57-wmr3
[2] https://github.com/symfony/symfony/commit/9da9a145ce57e4585031ad4bee37c497353eec7c

Regards,
Salvatore

Marked as found in versions symfony/5.4.29+dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:03 GMT) (full text, mbox, link).

Marked as found in versions symfony/5.4.23+dfsg-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:04 GMT) (full text, mbox, link).

Marked as found in versions symfony/4.4.19+dfsg-2+deb11u3. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:04 GMT) (full text, mbox, link).

Marked as found in versions symfony/4.4.19+dfsg-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:05 GMT) (full text, mbox, link).

Marked as found in versions symfony/3.4.22+dfsg-2+deb10u2. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:06 GMT) (full text, mbox, link).

Marked as found in versions symfony/3.4.22+dfsg-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to submit@bugs.debian.org. (Sat, 11 Nov 2023 07:57:06 GMT) (full text, mbox, link).

Added tag(s) pending. Request was from David Prévot <taffit@debian.org> to control@bugs.debian.org. (Sat, 11 Nov 2023 17:33:04 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Nov 11 17:55:44 2023; Machine Name: bembo

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started