Packagist/friendsofsymfony1/symfony1 CVE-2024-28859: medium 5, EPSS 1.49%

Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency

Action: Upgrade friendsofsymfony1/symfony1 to 1.5.18 or later.

composer require friendsofsymfony1/symfony1:1.5.18

Affected

Fixed versions

Sources

• osv: GHSA-wjv8-pxr6-5f4r
• https://github.com/FriendsOfSymfony1/symfony1/security/advisories/GHSA-wjv8-pxr6-5f4r
• https://nvd.nist.gov/vuln/detail/CVE-2024-28859
• https://github.com/FriendsOfSymfony1/symfony1/commit/edb850f94fb4de18ca53d0d1824910d6e8130166
• https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/swiftmailer/CVE-2024-28859.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony1/symfony1/CVE-2024-28859.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/swiftmailer/swiftmailer/CVE-2024-28859.yaml
• https://github.com/FriendsOfSymfony1/symfony1

CVE-2024-28859 · published 2024-03-18T20:36:06Z · modified 2026-09-10T03:50:10.958358499Z · JSON