GHSA-9c3x-r3wp-mgxm

Source

https://github.com/advisories/GHSA-9c3x-r3wp-mgxm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-9c3x-r3wp-mgxm/GHSA-9c3x-r3wp-mgxm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9c3x-r3wp-mgxm

Aliases

CVE-2024-50342

Published

2024-11-06T15:16:09Z

Modified

2024-11-13T19:07:18.979377Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

Details

Description

When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.

Resolution

The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.

The fisrt patch for this issue is available here for branch 5.4.

The second one is available here for branch 5.4 also.

Credits

We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.

Database specific

{
    "nvd_published_at": "2024-11-06T21:15:05Z",
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-06T15:16:09Z"
}

References

Affected packages

Packagist / symfony/http-client

Package

Name: symfony/http-client
Purl: pkg:composer/symfony/http-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.3.0

Fixed

5.4.47

Affected versions

v4.*

v4.3.0

v4.3.1

v4.3.2

v4.3.3

v4.3.4

v4.3.5

v4.3.6

v4.3.7

v4.3.8

v4.3.9

v4.3.10

v4.3.11

v4.4.0-BETA1

v4.4.0-BETA2

v4.4.0-RC1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.4.4

v4.4.5

v4.4.6

v4.4.7

v4.4.8

v4.4.9

v4.4.10

v4.4.11

v4.4.12

v4.4.13

v4.4.14

v4.4.15

v4.4.16

v4.4.17

v4.4.18

v4.4.19

v4.4.20

v4.4.21

v4.4.22

v4.4.23

v4.4.24

v4.4.25

v4.4.26

v4.4.27

v4.4.31

v4.4.33

v4.4.34

v4.4.35

v4.4.36

v4.4.37

v4.4.38

v4.4.39

v4.4.40

v4.4.41

v4.4.42

v4.4.44

v4.4.45

v4.4.46

v4.4.47

v4.4.49

v4.4.51

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

v5.0.9

v5.0.10

v5.0.11

v5.1.0-BETA1

v5.1.0-RC1

v5.1.0-RC2

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.1.7

v5.1.8

v5.1.9

v5.1.10

v5.1.11

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.2.0-RC1

v5.2.0-RC2

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.2.10

v5.2.11

v5.2.12

v5.3.0-BETA1

v5.3.0-BETA4

v5.3.0-RC1

v5.3.0

v5.3.2

v5.3.3

v5.3.4

v5.3.7

v5.3.8

v5.3.10

v5.3.11

v5.3.13

v5.3.14

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.5

v5.4.7

v5.4.8

v5.4.9

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.19

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.29

v5.4.31

v5.4.34

v5.4.35

v5.4.36

v5.4.37

v5.4.38

v5.4.39

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

Packagist / symfony/http-client

Package

Name: symfony/http-client
Purl: pkg:composer/symfony/http-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.4.15

Affected versions

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.5

v6.0.7

v6.0.8

v6.0.9

v6.0.11

v6.0.12

v6.0.13

v6.0.14

v6.0.15

v6.0.16

v6.0.17

v6.0.19

v6.0.20

v6.1.0-BETA1

v6.1.0-BETA2

v6.1.0-RC1

v6.1.0

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.1.11

v6.1.12

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.2.0-RC1

v6.2.0

v6.2.2

v6.2.5

v6.2.6

v6.2.7

v6.2.8

v6.2.9

v6.2.10

v6.2.11

v6.2.12

v6.2.13

v6.3.0-BETA1

v6.3.0-BETA2

v6.3.0-BETA3

v6.3.0-RC1

v6.3.0

v6.3.1

v6.3.2

v6.3.5

v6.3.6

v6.3.7

v6.3.8

v6.3.11

v6.3.12

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.0

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

Packagist / symfony/http-client

Package

Name: symfony/http-client
Purl: pkg:composer/symfony/http-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.1.8

Affected versions

v7.*

v7.0.0

v7.0.2

v7.0.3

v7.0.4

v7.0.5

v7.0.6

v7.0.7

v7.0.8

v7.0.9

v7.0.10

v7.1.0-BETA1

v7.1.0-RC1

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.1.4

v7.1.5

v7.1.6

v7.1.7

Packagist / symfony/symfony

Package

Name: symfony/symfony
Purl: pkg:composer/symfony/symfony

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.3.0

Fixed

5.4.47

Affected versions

v4.*

v4.3.0

v4.3.1

v4.3.2

v4.3.3

v4.3.4

v4.3.5

v4.3.6

v4.3.7

v4.3.8

v4.3.9

v4.3.10

v4.3.11

v4.4.0-BETA1

v4.4.0-BETA2

v4.4.0-RC1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.4.4

v4.4.5

v4.4.6

v4.4.7

v4.4.8

v4.4.9

v4.4.10

v4.4.11

v4.4.12

v4.4.13

v4.4.14

v4.4.15

v4.4.16

v4.4.17

v4.4.18

v4.4.19

v4.4.20

v4.4.21

v4.4.22

v4.4.23

v4.4.24

v4.4.25

v4.4.26

v4.4.27

v4.4.28

v4.4.29

v4.4.30

v4.4.31

v4.4.32

v4.4.33

v4.4.34

v4.4.35

v4.4.36

v4.4.37

v4.4.38

v4.4.39

v4.4.40

v4.4.41

v4.4.42

v4.4.43

v4.4.44

v4.4.45

v4.4.46

v4.4.47

v4.4.48

v4.4.49

v4.4.50

v4.4.51

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.0.0

v5.0.1

v5.0.2

v5.0.3

v5.0.4

v5.0.5

v5.0.6

v5.0.7

v5.0.8

v5.0.9

v5.0.10

v5.0.11

v5.1.0-BETA1

v5.1.0-RC1

v5.1.0-RC2

v5.1.0

v5.1.1

v5.1.2

v5.1.3

v5.1.4

v5.1.5

v5.1.6

v5.1.7

v5.1.8

v5.1.9

v5.1.10

v5.1.11

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.2.0-RC1

v5.2.0-RC2

v5.2.0

v5.2.1

v5.2.2

v5.2.3

v5.2.4

v5.2.5

v5.2.6

v5.2.7

v5.2.8

v5.2.9

v5.2.10

v5.2.11

v5.2.12

v5.2.13

v5.2.14

v5.3.0-BETA1

v5.3.0-BETA2

v5.3.0-BETA3

v5.3.0-BETA4

v5.3.0-RC1

v5.3.0

v5.3.1

v5.3.2

v5.3.3

v5.3.4

v5.3.5

v5.3.6

v5.3.7

v5.3.8

v5.3.9

v5.3.10

v5.3.11

v5.3.12

v5.3.13

v5.3.14

v5.3.15

v5.3.16

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.0

v5.4.1

v5.4.2

v5.4.3

v5.4.4

v5.4.5

v5.4.6

v5.4.7

v5.4.8

v5.4.9

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.18

v5.4.19

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.27

v5.4.28

v5.4.29

v5.4.30

v5.4.31

v5.4.32

v5.4.33

v5.4.34

v5.4.35

v5.4.36

v5.4.37

v5.4.38

v5.4.39

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

Packagist / symfony/symfony

Package

Name: symfony/symfony
Purl: pkg:composer/symfony/symfony

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Fixed

6.4.15

Affected versions

v6.*

v6.0.0

v6.0.1

v6.0.2

v6.0.3

v6.0.4

v6.0.5

v6.0.6

v6.0.7

v6.0.8

v6.0.9

v6.0.10

v6.0.11

v6.0.12

v6.0.13

v6.0.14

v6.0.15

v6.0.16

v6.0.17

v6.0.18

v6.0.19

v6.0.20

v6.1.0-BETA1

v6.1.0-BETA2

v6.1.0-RC1

v6.1.0

v6.1.1

v6.1.2

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.1.10

v6.1.11

v6.1.12

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.2.0-RC1

v6.2.0-RC2

v6.2.0

v6.2.1

v6.2.2

v6.2.3

v6.2.4

v6.2.5

v6.2.6

v6.2.7

v6.2.8

v6.2.9

v6.2.10

v6.2.11

v6.2.12

v6.2.13

v6.2.14

v6.3.0-BETA1

v6.3.0-BETA2

v6.3.0-BETA3

v6.3.0-RC1

v6.3.0-RC2

v6.3.0

v6.3.1

v6.3.2

v6.3.3

v6.3.4

v6.3.5

v6.3.6

v6.3.7

v6.3.8

v6.3.9

v6.3.10

v6.3.11

v6.3.12

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.0

v6.4.1

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

Packagist / symfony/symfony

Package

Name: symfony/symfony
Purl: pkg:composer/symfony/symfony

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.1.8

Affected versions

v7.*

v7.0.0

v7.0.1

v7.0.2

v7.0.3

v7.0.4

v7.0.5

v7.0.6

v7.0.7

v7.0.8

v7.0.9

v7.0.10

v7.1.0-BETA1

v7.1.0-RC1

v7.1.0

v7.1.1

v7.1.2

v7.1.3

v7.1.4

v7.1.5

v7.1.6

v7.1.7