Advisories for package symfony/security

Listing reported advisories for package symfony/security sorted by their report date.

Prevent user enumeration using Guard or the new Authenticator-based Security
GitHub

symfony/security

>= 2.11.0, < 2.11.3 · >= 1.30.0, < 1.31.1 · >= 1.27.0, < 1.29.2 · >= 4.0.0, < 4.4.24 · >= 4.0.0, < 4.4.23 · >= 2.8.0, < 3.4.49 · >= 2.8.0, < 3.4.48 · >= 2.0.0, < 2.10.7 · >= 5.1.0, < 5.2.8 · >= 5.0.0, < 5.2.9 · >= 5.0.0, < 5.2.8

2024-02-26 12:40:00
CVE-2021-21424: Prevent user enumeration via response content in authentication mechanisms
FriendsOfPHP

symfony/security

>=4.4.0, <4.4.24 · >=3.4.0, <3.4.49 · >=4.3.0, <4.4.0 · >=4.2.0, <4.3.0 · >=4.1.0, <4.2.0 · >=4.0.0, <4.1.0 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.8.0, <3.0.0

2021-05-12 08:00:00
Firewall configured with unanimous strategy was not actually unanimous in Symfony
GitHub

symfony/security

>= 5.0.0, < 5.0.7 · >= 4.4.0, < 4.4.7

2020-03-30 19:45:29
CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy
FriendsOfPHP

symfony/security

>=4.4.0, <4.4.7

2020-03-30 14:00:00
CVE-2019-10911: Add a separator in the remember me cookie hash
FriendsOfPHP

symfony/security

>=4.1.0, <4.1.12 · >=3.4.0, <3.4.26 · >=2.8.0, <2.8.50 · >=2.7.0, <2.7.51 · >=4.2.0, <4.2.7 · >=4.0.0, <4.1.0 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2019-04-16 10:54:35
CVE-2018-19790: Open Redirect Vulnerability on login
FriendsOfPHP

symfony/security

>=2.7.38, <2.7.50 · >=4.0.0, <4.0.15 · >=3.4.0, <3.4.19 · >=2.8.0, <2.8.49 · >=4.2.0, <4.2.1 · >=4.1.0, <4.1.9 · >=3.3.0, <3.4.0 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-11-06 11:52:00
CVE-2018-11407: Unauthorized access on a misconfigured LDAP server when using an empty password
FriendsOfPHP

symfony/security

>=3.3.0, <3.3.17 · >=2.8.0, <2.8.37 · >=4.0.0, <4.0.7 · >=3.4.0, <3.4.7 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2018-05-25 14:04:47
CVE-2018-11406: CSRF Token Fixation
FriendsOfPHP

symfony/security

>=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=2.7.0, <2.7.48 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-05-25 14:04:47
CVE-2018-11385: Session Fixation Issue for Guard Authentication
FriendsOfPHP

symfony/security

>=4.0.0, <4.0.11 · >=3.4.0, <3.4.11 · >=3.3.0, <3.3.17 · >=2.8.0, <2.8.41 · >=2.7.0, <2.7.48 · >=3.2.0, <3.3.0 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0 · >=2.3.0, <2.4.0 · >=2.2.0, <2.3.0 · >=2.1.0, <2.2.0 · >=2.0.0, <2.1.0

2018-05-25 14:04:47
CVE-2017-16653: CSRF protection does not use different tokens for HTTP and HTTPS
FriendsOfPHP

symfony/security

>=3.3.0, <3.3.13 · >=3.2.0, <3.2.14 · >=2.8.0, <2.8.31 · >=2.7.0, <2.7.38 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2017-11-16 15:24:32
CVE-2017-16652: Open redirect vulnerability on security handlers
FriendsOfPHP

symfony/security

>=3.3.0, <3.3.13 · >=3.2.0, <3.2.14 · >=2.8.0, <2.8.31 · >=2.7.0, <2.7.38 · >=3.1.0, <3.2.0 · >=3.0.0, <3.1.0

2017-11-16 15:24:32
CVE-2017-11365: Empty passwords validation issue
FriendsOfPHP

symfony/security

>=3.2.10, <3.2.12 · >=2.8.23, <2.8.25 · >=2.7.30, <2.7.32 · >=3.3.3, <3.3.5

2017-07-17 10:54:11
CVE-2016-2403: Unauthorized access on a misconfigured Ldap server when using an empty password
FriendsOfPHP

symfony/security

>=3.0.0, <3.0.6 · >=2.8.0, <2.8.6

2016-05-09 21:35:23
CVE-2016-4423: Large username storage in session
FriendsOfPHP

symfony/security

>=2.7.0, <2.7.13 · >=2.3.0, <2.3.41 · >=3.0.0, <3.0.6 · >=2.8.0, <2.8.6 · >=2.6.0, <2.7.0 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0

2016-05-09 21:31:02
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
FriendsOfPHP

symfony/security

>=2.6.0, <2.6.13 · >=2.3.0, <2.3.37 · >=2.7.0, <2.7.9 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0

2016-01-14 10:07:40
CVE-2015-8125: Potential Remote Timing Attack Vulnerability in Security Remember-Me Service
FriendsOfPHP

symfony/security

>=2.6.0, <2.6.12 · >=2.3.0, <2.3.35 · >=2.7.0, <2.7.7 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0

2015-11-23 12:58:37
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
FriendsOfPHP

symfony/security

>=2.6.0, <2.6.12 · >=2.3.0, <2.3.35 · >=2.7.0, <2.7.7 · >=2.5.0, <2.6.0 · >=2.4.0, <2.5.0

2015-11-23 12:58:37
Possible DOS attack with long user-submitted passwords
FriendsOfPHP

symfony/security

>=2.1.0, <2.1.13 · >=2.0.0, <2.0.25 · >=2.3.0, <2.3.6 · >=2.2.0, <2.2.9

2013-10-10 08:30:51
Routes behind a firewall are accessible even when not logged in
FriendsOfPHP

symfony/security

>=2.0.0, <2.0.19

2012-03-19 15:59:52