{"action":"Upgrade symfony/symfony to 4.4.50 or later.","affected":[{"fixed":"4.4.50","introduced":"2.0.0"},{"fixed":"5.4.20","introduced":"5.0.0"},{"fixed":"6.0.20","introduced":"6.0.0"},{"fixed":"6.1.12","introduced":"6.1.0"},{"fixed":"6.2.6","introduced":"6.2.0"}],"component":"symfony/symfony","cve_ids":["CVE-2022-24894"],"ecosystem":"Packagist","epss":0.03998,"exploited":false,"fixed_versions":["4.4.50","5.4.20","6.0.20","6.1.12","6.2.6"],"ghsa_id":"GHSA-h7vf-5wrv-9fhv","id":"tcs_01M5KF3FPW8EESZABFSPYWJ5W7","modified_at":"2025-02-13T19:02:16.092641Z","published_at":"2023-02-01T18:48:09Z","references":["https://osv.dev/vulnerability/GHSA-h7vf-5wrv-9fhv","https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv","https://nvd.nist.gov/vuln/detail/CVE-2022-24894","https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2022-24894.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24894.yaml","https://github.com/symfony/symfony","https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html","https://symfony.com/cve-2022-24894"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-h7vf-5wrv-9fhv#Packagist/symfony/symfony","url":"https://osv.dev/vulnerability/GHSA-h7vf-5wrv-9fhv"}],"summary":"Symfony storing cookie headers in HttpCache"}