Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.1572
[DLA 1778-1] symfony security update
7 May 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: symfony
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-10913 CVE-2019-10911 CVE-2019-10910
CVE-2019-10909
Reference: ESB-2019.1345
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2019/05/msg00007.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Package : symfony
Version : 2.3.21+dfsg-4+deb8u5
CVE ID : CVE-2019-10909 CVE-2019-10910 CVE-2019-10911
CVE-2019-10913
Several security vulnerabilities have been discovered in symfony, a PHP
web application framework. Numerous symfony components are affected:
Framework Bundle, Dependency Injection, Security, HttpFoundation
CVE-2019-10909
Validation messages were not escaped when using the form theme of
the PHP templating engine which, when validation messages may
contain user input, could result in an XSS.
For further information, see the upstream advisory at
https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in-the-php-templating-engine
CVE-2019-10910
Service IDs derived from unfiltered user input could result in the
execution of any arbitrary code, resulting in possible remote code
execution.
For further information, see the upstream advisory at
https://symfony.com/blog/cve-2019-10910-check-service-ids-are-valid
CVE-2019-10911
This fixes situations where part of an expiry time in a cookie could
be considered part of the username, or part of the username could be
considered part of the expiry time. An attacker could modify the
remember me cookie and authenticate as a different user. This attack
is only possible if remember me functionality is enabled and the two
users share a password hash or the password hashes (e.g.
UserInterface::getPassword()) are null for all users (which is valid
if passwords are checked by an external system, e.g. an SSO).
For further information, see the upstream advisory at
https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
CVE-2019-10913
HTTP methods, from either the HTTP method itself or using the
X-Http-Method-Override header were previously returned as the method
in question without validation being done on the string, meaning
that they could be used in dangerous contexts when left unescaped.
For further information, see the upstream advisory at
https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
For Debian 8 "Jessie", these problems have been fixed in version
2.3.21+dfsg-4+deb8u5.
We recommend that you upgrade your symfony packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- - --
Jonas Meurer
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEELIzSg9Pv30M4kOeDUmLn/0kQSf4FAlzQh9UACgkQUmLn/0kQ
Sf7pWxAAtYjN2qxy1HVoLYS/tG8C4I5BH5E5n2unqrkC+5djku4tg9RZf/3IpbJ6
iDQI/qWNUzbq3NvMISmPF0PnAFG+MzMgQrQZxBAZof81ZglD8c258+oESZBSJC9r
iQThGUJEKcPtMDD/2tory83Q+KtlYr8gvEZj3kOKTDw+W8ThGQ+ErfNnFBhWTnNm
iOWquQTl490155bCAn7Phaw+0MB+K8mJqSWTF8UNsyLHMiDFLTdtygzKnurjgoOW
YNbNrHbAxMd58R6i5GrtNpUnWohsF/q6fgywhN6Mxt3+ojwtsf6YKVK7pahXo/kD
uGmhf/BOl2PvIOFixWSQ9ZuYrLaS+yHt2LChvj6comPjRVelQvOomCq02DGK9gcV
NgWsro+HOTuO3KxY8AeQvIDpoMEpy5G5uiuoUt9bJxs4Dp+rics4unLWm1Q5BobE
kwBcfZ+t8llkZj0P0RyjWMKn1gP6mvGQWd+0vxVYqxfLoBF0HxQcY2+EZgigb1hR
LvXd2UFQDY3auZu6SlyahV6d66cYQoGUiMDEV7aUdmeOZcpwO8O8hFpZzmdzSXRm
2XC+OH4vR9nEHE604s8yxqEv5v6LUPAboE3FP4djSKDdXC1TXS4ls0cKKeSPQYLK
S1VmpAWlUb0AGJVP+7Krui3Fpx76HrNVFpx1MSEz+3MVcfcvFoM=
=C1Jm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXNDUrWaOgq3Tt24GAQg4Fw//SJQVn5uCkblK54KQaS/r4OAh7RaOTN1a
R+RVHWhWj/116eCYLm0QCAAjWZ0ueDYPb0v5B9oLqWkLCElO1ZrUjO0R6416WuJ/
9S4eNjNFJG8lW6VqD7u1NS2EYlwmRtBz2mnUFsaSSFsbAMeuWcK6SZB0vpfPDOC+
/B+NXXOnPI/hVgs5KYcPPlrx7DVEESIWMDgwkHXvan8hyOdhFcNjQgVCQtmtniUW
3vP3pbX4NzOblxfGp2hnUT34zUNBCIcYzoTqUIKAXjRlnBV3b7XXcSxvBYNdiSYb
N5cNAJ4CMNlBpQ35uEaFD7u13ThWywwsVH/VgDyGfBCeubmPQlQxjQ5Ja7R8dnC8
hIGVqf9vRoG/kPLJb1uWdhlP6p/fH9LgW5rpJcl1r1f8Yj1rPgrI0otS5avxLc2x
fcAzF/CCcM8srZKrEiztKOsDCFf8GknEEXhyMe/eTg/RVgmpj3hEjQ3dwtkgMboT
HSBO6TQhRhz58OwhPZBdZQJFqWaF++GP2BjAcLJ/jkOqfwC8CecUWA+Fhq4GhzzC
sqNhJ974WdRK1Auq2xcSKKJi8UMlrVLWTlAO5NycQlV4Ux0owhlKHvL6cHYH0j8X
FHk+UF92LtGig5QzOjvR5XV+shf3hc28yQLSCZEQmDAffDNp9DROJTdOtBx1HsEZ
emIMInCcZ3A=
=x6cv
-----END PGP SIGNATURE-----