{"action":"Upgrade symfony/symfony to 2.7.49 or later.","affected":[{"fixed":"2.7.49","introduced":"2.7.0"},{"fixed":"2.8.44","introduced":"2.8.0"},{"fixed":"3.3.18","introduced":"3.0.0"},{"fixed":"3.4.14","introduced":"3.4.0"},{"fixed":"4.0.14","introduced":"4.0.0"},{"fixed":"4.1.3","introduced":"4.1.0"}],"component":"symfony/symfony","cve_ids":["CVE-2018-14773"],"ecosystem":"Packagist","epss":0.57638,"exploited":false,"fixed_versions":["2.7.49","2.8.44","3.3.18","3.4.14","4.0.14","4.1.3"],"ghsa_id":"GHSA-8wgj-6wx8-h5hq","id":"tcs_01M5KEZDN1GCFN72JNV5BKZ7VG","modified_at":"2024-02-16T08:07:04.694964Z","published_at":"2022-05-13T01:05:42Z","references":["https://osv.dev/vulnerability/GHSA-8wgj-6wx8-h5hq","https://nvd.nist.gov/vuln/detail/CVE-2018-14773","https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-14773.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-14773.yaml","https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html","https://seclists.org/bugtraq/2019/May/21","https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers","https://www.debian.org/security/2019/dsa-4441","https://www.drupal.org/SA-CORE-2018-005","http://www.securityfocus.com/bid/104943","http://www.securitytracker.com/id/1041405"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-8wgj-6wx8-h5hq#Packagist/symfony/symfony","url":"https://osv.dev/vulnerability/GHSA-8wgj-6wx8-h5hq"}],"summary":"Symfony HTTP Foundation web cache poisoning"}