The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3493 advisory.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The     ability to enumerate users was possible without relevant permissions due to different handling depending     on whether the user existed or not when attempting to use the switch users functionality. We now ensure     that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user     does not exist. The patch for this issue is available for branch 3.4. (CVE-2021-21424)

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The     Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and     returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might     contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill     stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's     session. This issue has been patched and is available for branch 4.4. (CVE-2022-24894)

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When     authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of     session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site     attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.
    This issue has been fixed in the 4.4 branch. (CVE-2022-24895)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3493-1 : symfony - LTS security update

high Nessus Plugin ID 178174

Version 1.0