Packagist/symfony/security-http CVE-2019-10911: high 7.5, EPSS 1.21%

Improper authentication in Symfony

Action: Upgrade symfony/security-http to 2.7.51 or later.

composer require symfony/security-http:2.7.51

composer require symfony/security-http:2.8.50

composer require symfony/security-http:3.4.26

composer require symfony/security-http:4.1.12

composer require symfony/security-http:4.2.7

Affected

Fixed versions

Sources

• osv: GHSA-cchx-mfrc-fwqr
• https://nvd.nist.gov/vuln/detail/CVE-2019-10911
• https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-10911.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2019-10911.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10911.yaml
• https://github.com/symfony/symfony
• https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
• https://symfony.com/cve-2019-10911
• https://www.synology.com/security/advisory/Synology_SA_19_19

CVE-2019-10911 · published 2020-02-12T18:45:08Z · modified 2024-02-16T08:07:16.124191Z · JSON