Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
The advisory, in context
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.7.0 before 2.7.51
Fixed in 2.7.51
51 explicitly affected versions
v2.7.0, v2.7.1, v2.7.10, v2.7.11, v2.7.12, v2.7.13, v2.7.14, v2.7.15, v2.7.16, v2.7.17, v2.7.18, v2.7.19, v2.7.2, v2.7.20, v2.7.21, v2.7.22, v2.7.23, v2.7.24, v2.7.25, v2.7.26, v2.7.27, v2.7.28, v2.7.29, v2.7.3, v2.7.30, v2.7.31, v2.7.32, v2.7.33, v2.7.34, v2.7.35, v2.7.36, v2.7.37, v2.7.38, v2.7.39, v2.7.4, v2.7.40, v2.7.41, v2.7.42, v2.7.43, v2.7.44, v2.7.45, v2.7.46, v2.7.47, v2.7.48, v2.7.49, v2.7.5, v2.7.50, v2.7.6, v2.7.7, v2.7.8, v2.7.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.51"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.7.0",
"v2.7.1",
"v2.7.10",
"v2.7.11",
"v2.7.12",
"v2.7.13",
"v2.7.14",
"v2.7.15",
"v2.7.16",
"v2.7.17",
"v2.7.18",
"v2.7.19",
"v2.7.2",
"v2.7.20",
"v2.7.21",
"v2.7.22",
"v2.7.23",
"v2.7.24",
"v2.7.25",
"v2.7.26",
"v2.7.27",
"v2.7.28",
"v2.7.29",
"v2.7.3",
"v2.7.30",
"v2.7.31",
"v2.7.32",
"v2.7.33",
"v2.7.34",
"v2.7.35",
"v2.7.36",
"v2.7.37",
"v2.7.38",
"v2.7.39",
"v2.7.4",
"v2.7.40",
"v2.7.41",
"v2.7.42",
"v2.7.43",
"v2.7.44",
"v2.7.45",
"v2.7.46",
"v2.7.47",
"v2.7.48",
"v2.7.49",
"v2.7.5",
"v2.7.50",
"v2.7.6",
"v2.7.7",
"v2.7.8",
"v2.7.9"
]
}From 2.8.0 before 2.8.50
Fixed in 2.8.50
50 explicitly affected versions
v2.8.0, v2.8.1, v2.8.10, v2.8.11, v2.8.12, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.17, v2.8.18, v2.8.19, v2.8.2, v2.8.20, v2.8.21, v2.8.22, v2.8.23, v2.8.24, v2.8.25, v2.8.26, v2.8.27, v2.8.28, v2.8.29, v2.8.3, v2.8.30, v2.8.31, v2.8.32, v2.8.33, v2.8.34, v2.8.35, v2.8.36, v2.8.37, v2.8.38, v2.8.39, v2.8.4, v2.8.40, v2.8.41, v2.8.42, v2.8.43, v2.8.44, v2.8.45, v2.8.46, v2.8.47, v2.8.48, v2.8.49, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.8.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.8.0",
"v2.8.1",
"v2.8.10",
"v2.8.11",
"v2.8.12",
"v2.8.13",
"v2.8.14",
"v2.8.15",
"v2.8.16",
"v2.8.17",
"v2.8.18",
"v2.8.19",
"v2.8.2",
"v2.8.20",
"v2.8.21",
"v2.8.22",
"v2.8.23",
"v2.8.24",
"v2.8.25",
"v2.8.26",
"v2.8.27",
"v2.8.28",
"v2.8.29",
"v2.8.3",
"v2.8.30",
"v2.8.31",
"v2.8.32",
"v2.8.33",
"v2.8.34",
"v2.8.35",
"v2.8.36",
"v2.8.37",
"v2.8.38",
"v2.8.39",
"v2.8.4",
"v2.8.40",
"v2.8.41",
"v2.8.42",
"v2.8.43",
"v2.8.44",
"v2.8.45",
"v2.8.46",
"v2.8.47",
"v2.8.48",
"v2.8.49",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.8.9"
]
}From 3.0.0 before 3.4.26
Fixed in 3.4.26
94 explicitly affected versions
v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.0-BETA1, v3.1.0-RC1, v3.1.1, v3.1.10, v3.1.2, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-BETA1, v3.2.0-RC1, v3.2.0-RC2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-BETA1, v3.3.0-RC1, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-BETA1, v3.4.0-BETA2, v3.4.0-BETA3, v3.4.0-BETA4, v3.4.0-RC1, v3.4.0-RC2, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.19, v3.4.2, v3.4.20, v3.4.21, v3.4.22, v3.4.23, v3.4.24, v3.4.25, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.0-BETA1",
"v3.1.0-RC1",
"v3.1.1",
"v3.1.10",
"v3.1.2",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-RC2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-BETA1",
"v3.3.0-RC1",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-BETA1",
"v3.4.0-BETA2",
"v3.4.0-BETA3",
"v3.4.0-BETA4",
"v3.4.0-RC1",
"v3.4.0-RC2",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.19",
"v3.4.2",
"v3.4.20",
"v3.4.21",
"v3.4.22",
"v3.4.23",
"v3.4.24",
"v3.4.25",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.0.0 before 4.1.12
Fixed in 4.1.12
31 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-BETA1, v4.1.0-BETA2, v4.1.0-BETA3, v4.1.1, v4.1.10, v4.1.11, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-BETA1",
"v4.1.0-BETA2",
"v4.1.0-BETA3",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9"
]
}From 4.2.0 before 4.2.7
Fixed in 4.2.7
7 explicitly affected versions
v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6"
]
}From 2.7.0 before 2.7.51
Fixed in 2.7.51
51 explicitly affected versions
v2.7.0, v2.7.1, v2.7.10, v2.7.11, v2.7.12, v2.7.13, v2.7.14, v2.7.15, v2.7.16, v2.7.17, v2.7.18, v2.7.19, v2.7.2, v2.7.20, v2.7.21, v2.7.22, v2.7.23, v2.7.24, v2.7.25, v2.7.26, v2.7.27, v2.7.28, v2.7.29, v2.7.3, v2.7.30, v2.7.31, v2.7.32, v2.7.33, v2.7.34, v2.7.35, v2.7.36, v2.7.37, v2.7.38, v2.7.39, v2.7.4, v2.7.40, v2.7.41, v2.7.42, v2.7.43, v2.7.44, v2.7.45, v2.7.46, v2.7.47, v2.7.48, v2.7.49, v2.7.5, v2.7.50, v2.7.6, v2.7.7, v2.7.8, v2.7.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.51"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.7.0",
"v2.7.1",
"v2.7.10",
"v2.7.11",
"v2.7.12",
"v2.7.13",
"v2.7.14",
"v2.7.15",
"v2.7.16",
"v2.7.17",
"v2.7.18",
"v2.7.19",
"v2.7.2",
"v2.7.20",
"v2.7.21",
"v2.7.22",
"v2.7.23",
"v2.7.24",
"v2.7.25",
"v2.7.26",
"v2.7.27",
"v2.7.28",
"v2.7.29",
"v2.7.3",
"v2.7.30",
"v2.7.31",
"v2.7.32",
"v2.7.33",
"v2.7.34",
"v2.7.35",
"v2.7.36",
"v2.7.37",
"v2.7.38",
"v2.7.39",
"v2.7.4",
"v2.7.40",
"v2.7.41",
"v2.7.42",
"v2.7.43",
"v2.7.44",
"v2.7.45",
"v2.7.46",
"v2.7.47",
"v2.7.48",
"v2.7.49",
"v2.7.5",
"v2.7.50",
"v2.7.6",
"v2.7.7",
"v2.7.8",
"v2.7.9"
]
}From 2.8.0 before 2.8.50
Fixed in 2.8.50
50 explicitly affected versions
v2.8.0, v2.8.1, v2.8.10, v2.8.11, v2.8.12, v2.8.13, v2.8.14, v2.8.15, v2.8.16, v2.8.17, v2.8.18, v2.8.19, v2.8.2, v2.8.20, v2.8.21, v2.8.22, v2.8.23, v2.8.24, v2.8.25, v2.8.26, v2.8.27, v2.8.28, v2.8.29, v2.8.3, v2.8.30, v2.8.31, v2.8.32, v2.8.33, v2.8.34, v2.8.35, v2.8.36, v2.8.37, v2.8.38, v2.8.39, v2.8.4, v2.8.40, v2.8.41, v2.8.42, v2.8.43, v2.8.44, v2.8.45, v2.8.46, v2.8.47, v2.8.48, v2.8.49, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.8.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.50"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.8.0",
"v2.8.1",
"v2.8.10",
"v2.8.11",
"v2.8.12",
"v2.8.13",
"v2.8.14",
"v2.8.15",
"v2.8.16",
"v2.8.17",
"v2.8.18",
"v2.8.19",
"v2.8.2",
"v2.8.20",
"v2.8.21",
"v2.8.22",
"v2.8.23",
"v2.8.24",
"v2.8.25",
"v2.8.26",
"v2.8.27",
"v2.8.28",
"v2.8.29",
"v2.8.3",
"v2.8.30",
"v2.8.31",
"v2.8.32",
"v2.8.33",
"v2.8.34",
"v2.8.35",
"v2.8.36",
"v2.8.37",
"v2.8.38",
"v2.8.39",
"v2.8.4",
"v2.8.40",
"v2.8.41",
"v2.8.42",
"v2.8.43",
"v2.8.44",
"v2.8.45",
"v2.8.46",
"v2.8.47",
"v2.8.48",
"v2.8.49",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.8.9"
]
}From 3.0.0 before 3.4.26
Fixed in 3.4.26
94 explicitly affected versions
v3.0.0, v3.0.1, v3.0.2, v3.0.3, v3.0.4, v3.0.5, v3.0.6, v3.0.7, v3.0.8, v3.0.9, v3.1.0, v3.1.0-BETA1, v3.1.0-RC1, v3.1.1, v3.1.10, v3.1.2, v3.1.3, v3.1.4, v3.1.5, v3.1.6, v3.1.7, v3.1.8, v3.1.9, v3.2.0, v3.2.0-BETA1, v3.2.0-RC1, v3.2.0-RC2, v3.2.1, v3.2.10, v3.2.11, v3.2.12, v3.2.13, v3.2.14, v3.2.2, v3.2.3, v3.2.4, v3.2.5, v3.2.6, v3.2.7, v3.2.8, v3.2.9, v3.3.0, v3.3.0-BETA1, v3.3.0-RC1, v3.3.1, v3.3.10, v3.3.11, v3.3.12, v3.3.13, v3.3.14, v3.3.15, v3.3.16, v3.3.17, v3.3.18, v3.3.2, v3.3.3, v3.3.4, v3.3.5, v3.3.6, v3.3.7, v3.3.8, v3.3.9, v3.4.0, v3.4.0-BETA1, v3.4.0-BETA2, v3.4.0-BETA3, v3.4.0-BETA4, v3.4.0-RC1, v3.4.0-RC2, v3.4.1, v3.4.10, v3.4.11, v3.4.12, v3.4.13, v3.4.14, v3.4.15, v3.4.16, v3.4.17, v3.4.18, v3.4.19, v3.4.2, v3.4.20, v3.4.21, v3.4.22, v3.4.23, v3.4.24, v3.4.25, v3.4.3, v3.4.4, v3.4.5, v3.4.6, v3.4.7, v3.4.8, v3.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.26"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.1",
"v3.0.2",
"v3.0.3",
"v3.0.4",
"v3.0.5",
"v3.0.6",
"v3.0.7",
"v3.0.8",
"v3.0.9",
"v3.1.0",
"v3.1.0-BETA1",
"v3.1.0-RC1",
"v3.1.1",
"v3.1.10",
"v3.1.2",
"v3.1.3",
"v3.1.4",
"v3.1.5",
"v3.1.6",
"v3.1.7",
"v3.1.8",
"v3.1.9",
"v3.2.0",
"v3.2.0-BETA1",
"v3.2.0-RC1",
"v3.2.0-RC2",
"v3.2.1",
"v3.2.10",
"v3.2.11",
"v3.2.12",
"v3.2.13",
"v3.2.14",
"v3.2.2",
"v3.2.3",
"v3.2.4",
"v3.2.5",
"v3.2.6",
"v3.2.7",
"v3.2.8",
"v3.2.9",
"v3.3.0",
"v3.3.0-BETA1",
"v3.3.0-RC1",
"v3.3.1",
"v3.3.10",
"v3.3.11",
"v3.3.12",
"v3.3.13",
"v3.3.14",
"v3.3.15",
"v3.3.16",
"v3.3.17",
"v3.3.18",
"v3.3.2",
"v3.3.3",
"v3.3.4",
"v3.3.5",
"v3.3.6",
"v3.3.7",
"v3.3.8",
"v3.3.9",
"v3.4.0",
"v3.4.0-BETA1",
"v3.4.0-BETA2",
"v3.4.0-BETA3",
"v3.4.0-BETA4",
"v3.4.0-RC1",
"v3.4.0-RC2",
"v3.4.1",
"v3.4.10",
"v3.4.11",
"v3.4.12",
"v3.4.13",
"v3.4.14",
"v3.4.15",
"v3.4.16",
"v3.4.17",
"v3.4.18",
"v3.4.19",
"v3.4.2",
"v3.4.20",
"v3.4.21",
"v3.4.22",
"v3.4.23",
"v3.4.24",
"v3.4.25",
"v3.4.3",
"v3.4.4",
"v3.4.5",
"v3.4.6",
"v3.4.7",
"v3.4.8",
"v3.4.9"
]
}From 4.0.0 before 4.1.12
Fixed in 4.1.12
31 explicitly affected versions
v4.0.0, v4.0.1, v4.0.10, v4.0.11, v4.0.12, v4.0.13, v4.0.14, v4.0.15, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.0-BETA1, v4.1.0-BETA2, v4.1.0-BETA3, v4.1.1, v4.1.10, v4.1.11, v4.1.2, v4.1.3, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.0.0",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.12",
"v4.0.13",
"v4.0.14",
"v4.0.15",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.0-BETA1",
"v4.1.0-BETA2",
"v4.1.0-BETA3",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.2",
"v4.1.3",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9"
]
}From 4.2.0 before 4.2.7
Fixed in 4.2.7
7 explicitly affected versions
v4.2.0, v4.2.1, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v4.2.0",
"v4.2.1",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10913
- https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml
- https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides
- https://symfony.com/cve-2019-10913