CVE-2018-14774
CVE-2018-14774
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
CVSS 7.2 · High · EPSS 1.1% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
symfony Debian:12
- Affected ranges
- ECOSYSTEM: < 3.4.14+dfsg-1
Update to 3.4.14+dfsg-1
symfony Debian:13
- Affected ranges
- ECOSYSTEM: < 3.4.14+dfsg-1
Update to 3.4.14+dfsg-1
symfony Debian:14
- Affected ranges
- ECOSYSTEM: < 3.4.14+dfsg-1
Update to 3.4.14+dfsg-1
symfony/symfony Packagist
- Versions
- v2.7.0
- v2.7.1
- v2.7.10
- v2.7.11
- v2.7.12
- v2.7.13
- v2.7.14
- v2.7.15
- v2.7.16
- v2.7.17
- v2.7.18
- v2.7.19
- v2.7.2
- v2.7.20
- v2.7.21
- v2.7.22
- v2.7.23
- v2.7.24
- v2.7.25
- v2.7.26
- v2.7.27
- v2.7.28
- v2.7.29
- v2.7.3
- v2.7.30
- v2.7.31
- v2.7.32
- v2.7.33
- v2.7.34
- v2.7.35
- v2.7.36
- v2.7.37
- v2.7.38
- v2.7.39
- v2.7.4
- v2.7.40
- v2.7.41
- v2.7.42
- v2.7.43
- v2.7.44
- v2.7.45
- v2.7.46
- v2.7.47
- v2.7.48
- v2.7.5
- v2.7.6
- v2.7.7
- v2.7.8
- v2.7.9
- Affected ranges
- ECOSYSTEM: ≥ 2.7.0, < 2.7.49
Update to 2.7.49
symfony/symfony Packagist
- Versions
- v2.8.0
- v2.8.1
- v2.8.10
- v2.8.11
- v2.8.12
- v2.8.13
- v2.8.14
- v2.8.15
- v2.8.16
- v2.8.17
- v2.8.18
- v2.8.19
- v2.8.2
- v2.8.20
- v2.8.21
- v2.8.22
- v2.8.23
- v2.8.24
- v2.8.25
- v2.8.26
- v2.8.27
- v2.8.28
- v2.8.29
- v2.8.3
- v2.8.30
- v2.8.31
- v2.8.32
- v2.8.33
- v2.8.34
- v2.8.35
- v2.8.36
- v2.8.37
- v2.8.38
- v2.8.39
- v2.8.4
- v2.8.40
- v2.8.41
- v2.8.42
- v2.8.43
- v2.8.5
- v2.8.6
- v2.8.7
- v2.8.8
- v2.8.9
- Affected ranges
- ECOSYSTEM: ≥ 2.8.0, < 2.8.44
Update to 2.8.44
symfony/symfony Packagist
- Versions
- v3.3.0
- v3.3.1
- v3.3.10
- v3.3.11
- v3.3.12
- v3.3.13
- v3.3.14
- v3.3.15
- v3.3.16
- v3.3.17
- v3.3.2
- v3.3.3
- v3.3.4
- v3.3.5
- v3.3.6
- v3.3.7
- v3.3.8
- v3.3.9
- Affected ranges
- ECOSYSTEM: ≥ 3.3.0, < 3.3.18
Update to 3.3.18
symfony/symfony Packagist
- Versions
- v3.4.0
- v3.4.1
- v3.4.10
- v3.4.11
- v3.4.12
- v3.4.13
- v3.4.2
- v3.4.3
- v3.4.4
- v3.4.5
- v3.4.6
- v3.4.7
- v3.4.8
- v3.4.9
- Affected ranges
- ECOSYSTEM: ≥ 3.4.0, < 3.4.14
Update to 3.4.14
symfony/symfony Packagist
- Versions
- v4.0.0
- v4.0.1
- v4.0.10
- v4.0.11
- v4.0.12
- v4.0.13
- v4.0.2
- v4.0.3
- v4.0.4
- v4.0.5
- v4.0.6
- v4.0.7
- v4.0.8
- v4.0.9
- Affected ranges
- ECOSYSTEM: ≥ 4.0.0, < 4.0.14
Update to 4.0.14
symfony/symfony Packagist
- Versions
- v4.1.0
- v4.1.1
- v4.1.2
- Affected ranges
- ECOSYSTEM: ≥ 4.1.0, < 4.1.3
Update to 4.1.3
symfony Ubuntu:16.04:LTS
- Versions
- 2.7.1+dfsg-1
- 2.7.5+dfsg-1
- 2.7.9+dfsg-1
- 2.7.9+dfsg-1ubuntu2
- 2.7.10-0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:18.04:LTS
- Versions
- 2.8.7+dfsg-1.3ubuntu1
- 3.4.3+dfsg-1ubuntu4
- 3.4.6+dfsg-1
- 3.4.6+dfsg-1ubuntu0.1
- 3.4.6+dfsg-1ubuntu0.1+esm1
- 3.4.6+dfsg-1ubuntu0.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published