CVE-2018-14774
1 advisory.
Packagist/symfony/symfony CVE-2018-14774: high 7.2
Symfony Host Header Injection
Action: Upgrade symfony/symfony to 2.7.49 or later.
composer require symfony/symfony:2.7.49composer require symfony/symfony:2.8.44composer require symfony/symfony:3.3.18composer require symfony/symfony:3.4.14composer require symfony/symfony:4.0.14composer require symfony/symfony:4.1.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7.0 | 2.7.49 | - |
| 2.8.0 | 2.8.44 | - |
| 3.3.0 | 3.3.18 | - |
| 3.4.0 | 3.4.14 | - |
| 4.0.0 | 4.0.14 | - |
| 4.1.0 | 4.1.3 | - |
Fixed versions
| 2.7.49 | 2.8.44 | 3.3.18 | 3.4.14 | 4.0.14 | 4.1.3 |
Sources
- osv: GHSA-66p6-7p29-55p9
- https://nvd.nist.gov/vuln/detail/CVE-2018-14774
- https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a
- https://github.com/symfony/symfony/commit/7f912bbb78377c2ea331b3da28363435fbd91337
- https://github.com/symfony/symfony/commit/96504fb8c9f91204727d2930eb837473ce154956
- https://github.com/symfony/symfony/commit/974240e178bb01d734bf1df1ad5c3beba6a2f982
- https://github.com/symfony/symfony/commit/9cfcaba0bf71f87683510b5f47ebaac5f5d6a5ba
- https://github.com/symfony/symfony/commit/bcf5897bb1a99d4acae8bf7b73e81bfdeaac0922
- https://github.com/symfony/symfony
- https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache
CVE-2018-14774 · published · modified · JSON