Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3493 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3493-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : symfony     Version        : 3.4.22+dfsg-2+deb10u2     CVE ID         : CVE-2021-21424 CVE-2022-24894 CVE-2022-24895

    Multiple security vulnerabilities were found in symfony, a PHP framework     for web and console applications and a set of reusable PHP components,     which could lead to information disclosure or impersonation.

    CVE-2021-21424

        James Isaac, Mathias Brodala and Laurent Minguet discovered that it         was possible to enumerate users without relevant permissions due to         different exception messages depending on whether the user existed         or not.  It was also possible to enumerate users by using a timing         attack, by comparing time elapsed when authenticating an existing         user and authenticating a non-existing user.

        403s are now returned whether the user exists or not if a user         cannot switch to a user or if the user does not exist.

    CVE-2022-24894

        Soner Sayakci discovered that when the Symfony HTTP cache system is         enabled, the response header might be stored with a `Set-Cookie`         header and returned to some other clients, thereby allowing an         attacker to retrieve the victim's session.

        The `HttpStore` constructor now takes a parameter containing a list         of private headers that are removed from the HTTP response headers.
        The default value for this parameter is `Set-Cookie`, but it can be         overridden or extended by the application.

    CVE-2022-24895

        Marco Squarcina discovered that CSRF tokens aren't cleared upon         login, which could enable same-site attackers to bypass the CSRF         protection mechanism by performing an attack similar to a         session-fixation.

    For Debian 10 buster, these problems have been fixed in version     3.4.22+dfsg-2+deb10u2.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-74b702f058 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-aecde14648 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
178174	Debian dla-3493 : php-symfony - security update	Nessus	Debian Local Security Checks	high
171375	Fedora 37 : php-symfony4 (2023-74b702f058)	Nessus	Fedora Local Security Checks	high
171373	Fedora 36 : php-symfony4 (2023-aecde14648)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-24895

high

Tenable Plugins

high

high

high