miladshakerdn
commented
2 years ago The Lumen framework needs to be updated
Closed mend-bolt-for-github[bot] closed 2 years ago
miladshakerdn
commented
2 years ago The Lumen framework needs to be updated
CVE-2021-41267 - Medium Severity Vulnerability
Symfony HttpKernel Component
Library home page: https://api.github.com/repos/symfony/http-kernel/zipball/a13b3c4d994a4fd051f4c6800c5e33c9508091dd
Dependency Hierarchy: - laravel/lumen-framework-v8.2.0 (Root Library) - :x: **symfony/http-kernel-v5.1.8** (Vulnerable Library)
Found in HEAD commit: b0c810e728768e655444c3e12cbf88a4ee27b5b5
Found in base branch: main
Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.
Publish Date: 2021-11-24
URL: CVE-2021-41267
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q
Release Date: 2021-11-24
Fix Resolution: v5.3.12
Step up your Open Source Security Game with WhiteSource here