An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.

Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution.

Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Security, bundle readers, session handling, SecurityBundle, HttpFoundation, Form, and Security\Http.

The corresponding upstream advisories contain further details :

[CVE-2017-16652] https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on
-security-handlers

[CVE-2017-16654] https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-o ut-of-paths

[CVE-2018-11385] https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-gua rd-authentication

[CVE-2018-11408] https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on
-security-handlers

[CVE-2018-14773] https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and- risky-http-headers

[CVE-2018-19789] https://symfony.com/blog/cve-2018-19789-disclosure-of-uploaded-files-f ull-path

[CVE-2018-19790] https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-wh en-using-security-http

For Debian 8 'Jessie', these problems have been fixed in version 2.3.21+dfsg-4+deb8u4.

We recommend that you upgrade your symfony packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 2.8.49** (2018-12-06)

  - security     [CVE-2018-19790](https://symfony.com/cve-2018-19790)     [Security\Http] detect bad redirect targets using     backslashes (@xabbuh)

  - security     [CVE-2018-19789](https://symfony.com/cve-2018-19789)     [Form] Filter file uploads out of regular form types     (@nicolas-grekas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 3.4.20** (2018-12-06)

  - security     [CVE-2018-19790](https://symfony.com/cve-2018-19790)     [Security\Http] detect bad redirect targets using     backslashes (@xabbuh)

  - security     [CVE-2018-19789](https://symfony.com/cve-2018-19789)     [Form] Filter file uploads out of regular form types     (@nicolas-grekas)

  - bug #29436 [Cache] Fixed Memcached adapter doClear()to     call flush() (raitocz)

  - bug #29441 [Routing] ignore trailing slash for non-GET     requests (nicolas-grekas)

  - bug #29432 [DI] dont inline when lazy edges are found     (nicolas-grekas)

  - bug #29413 [Serializer] fixed DateTimeNormalizer to     maintain microseconds when a different timezone required     (rvitaliy)

  - bug #29424 [Routing] fix taking verb into account when     redirecting (nicolas-grekas)

  - bug #29414 [DI] Fix dumping expressions accessing     single-use private services (chalasr)

  - bug #29375 [Validator] Allow     `ConstraintViolation::__toString()` to expose codes that     are not null or emtpy strings (phansys)

  - bug #29376 [EventDispatcher] Fix eventListener wrapper     loop in TraceableEventDispatcher (jderusse)

  - bug #29343 [Form] Handle all case variants of 'nan' when     parsing a number (mwhudson, xabbuh)

  - bug #29355 [PropertyAccess] calculate cache keys for     property setters depending on the value (xabbuh)

  - bug #29369 [DI] fix combinatorial explosion when     analyzing the service graph (nicolas-grekas)

  - bug #29349 [Debug] workaround opcache bug mutating     '$this' !?! (nicolas-grekas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 4.1.9** (2018-12-06)

  - security     [CVE-2018-19790](https://symfony.com/cve-2018-19790)     [Security\Http] detect bad redirect targets using     backslashes (@xabbuh)

  - security     [CVE-2018-19789](https://symfony.com/cve-2018-19789)     [Form] Filter file uploads out of regular form types     (@nicolas-grekas)

  - bug #29436 [Cache] Fixed Memcached adapter doClear()to     call flush() (raitocz)

  - bug #29441 [Routing] ignore trailing slash for non-GET     requests (nicolas-grekas)

  - bug #29444 [Workflow] Fixed BC break for Workflow     metadata (lyrixx)

  - bug #29432 [DI] dont inline when lazy edges are found     (nicolas-grekas)

  - bug #29413 [Serializer] fixed DateTimeNormalizer to     maintain microseconds when a different timezone required     (rvitaliy)

  - bug #29424 [Routing] fix taking verb into account when     redirecting (nicolas-grekas)

  - bug #29414 [DI] Fix dumping expressions accessing     single-use private services (chalasr)

  - bug #29375 [Validator] Allow     `ConstraintViolation::__toString()` to expose codes that     are not null or emtpy strings (phansys)

  - bug #29376 [EventDispatcher] Fix eventListener wrapper     loop in TraceableEventDispatcher (jderusse)

  - bug #29386 undeprecate the single-colon notation for     controllers (fbourigault)

  - bug #29393 [DI] fix edge case in     InlineServiceDefinitionsPass (nicolas-grekas)

  - bug #29380 [Routing] fix greediness of trailing slash     (nicolas-grekas)

  - bug #29343 [Form] Handle all case variants of 'nan' when     parsing a number (mwhudson, xabbuh)

  - bug #29373 [Routing] fix trailing slash redirection     (nicolas-grekas)

  - bug #29355 [PropertyAccess] calculate cache keys for     property setters depending on the value (xabbuh)

  - bug #29369 [DI] fix combinatorial explosion when     analyzing the service graph (nicolas-grekas)

  - bug #29349 [Debug] workaround opcache bug mutating     '$this' !?! (nicolas-grekas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 4.0.15** (2018-12-06)

  - security     [CVE-2018-19790](https://symfony.com/cve-2018-19790)     [Security\Http] detect bad redirect targets using     backslashes (@xabbuh)

  - security     [CVE-2018-19789](https://symfony.com/cve-2018-19789)     [Form] Filter file uploads out of regular form types     (@nicolas-grekas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124779	Debian DSA-4441-1 : symfony - security update	Nessus	Debian Local Security Checks	critical
122721	Debian DLA-1707-1 : symfony security update	Nessus	Debian Local Security Checks	high
120720	Fedora 29 : php-symfony (2018-b38a4dd0c7)	Nessus	Fedora Local Security Checks	medium
120600	Fedora 29 : php-symfony3 (2018-8d3a9bdff1)	Nessus	Fedora Local Security Checks	medium
120596	Fedora 28 : php-symfony (2018-8c06b6defd)	Nessus	Fedora Local Security Checks	medium
120580	Fedora 29 : php-symfony4 (2018-84a1f77d89)	Nessus	Fedora Local Security Checks	medium
120515	Fedora 28 : php-symfony4 (2018-6edf04d9d6)	Nessus	Fedora Local Security Checks	medium
120481	Fedora 28 : php-symfony3 (2018-66547a8c14)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-19789

medium

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium