p PatchFirst

CVE-2020-5255

CVE-2020-5255 · Prevent cache poisoning via a Response Content-Type header

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.

CVSS 2.6 · Low · EPSS 1.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • symfony

    Versions
    • >= 4.4.0 and < 4.4.7: Affected
    • >= 5.0.0 and < 5.0.7: Affected

    No fix published

  • symfony Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.4.8-1

    Update to 4.4.8-1

  • symfony Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.4.8-1

    Update to 4.4.8-1

  • symfony Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.4.8-1

    Update to 4.4.8-1

  • symfony/http-foundation Packagist

    Versions
    • v4.4.0
    • v4.4.1
    • v4.4.2
    • v4.4.3
    • v4.4.4
    • v4.4.5
    • v4.4.6
    Affected ranges
    • ECOSYSTEM: ≥ 4.4.0, < 4.4.7

    Update to 4.4.7

  • symfony/http-foundation Packagist

    Versions
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.0.3
    • v5.0.4
    • v5.0.5
    • v5.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.7

    Update to 5.0.7

  • symfony/symfony Packagist

    Versions
    • v4.4.0
    • v4.4.1
    • v4.4.2
    • v4.4.3
    • v4.4.4
    • v4.4.5
    • v4.4.6
    Affected ranges
    • ECOSYSTEM: ≥ 4.4.0, < 4.4.7

    Update to 4.4.7

  • symfony/symfony Packagist

    Versions
    • v5.0.0
    • v5.0.1
    • v5.0.2
    • v5.0.3
    • v5.0.4
    • v5.0.5
    • v5.0.6
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.0.7

    Update to 5.0.7

Original sources

Check your server →