GHSA-p9fg-j6ww-953m
GHSA-p9fg-j6ww-953m · FOSRestBundle issue with broken validation of JSONP callbacks
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Starting with FOSRestBundle 1.2 we [switched](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/642/files#diff-431bc57ca9ca16332c0cff43ad45263cR37) to using [willdurand/jsonp-callback-validator](https://github.com/willdurand/JsonpCallbackValidator) for validation of JSONP callbacks. However [the change was implemented](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/665) incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle [1.2.2](https://github.com/FriendsOfSymfony/FOSRestBundle/releases/tag/1.2.2).
Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
friendsofsymfony/rest-bundle Packagist
- Softwareversionen
- 1.2.0
- 1.2.1
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 1.2.0, < 1.2.2
Auf 1.2.2 aktualisieren
Originalquellen
- https://github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/rest-bundle/2014-01-22-1.yaml
- https://github.com/FriendsOfSymfony/FOSRestBundle
- https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler
- https://osv.dev/vulnerability/GHSA-p9fg-j6ww-953m