p PatchFirst

CVE-2024-50341

CVE-2024-50341 · Security::login does not take into account custom user_checker in symfony/security-bundle

This page contains facts from public vulnerability sources. Check the original advisory before updating.

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • symfony

    Versions
    • >= 6.2.0, < 6.4.10: Affected
    • >= 7.0.0, < 7.0.10: Affected
    • >= 7.1.0, < 7.1.3: Affected

    No fix published

  • symfony Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.4.10+dfsg-1

    Update to 6.4.10+dfsg-1

  • symfony Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.4.10+dfsg-1

    Update to 6.4.10+dfsg-1

  • symfony/security-bundle Packagist

    Versions
    • v6.2.0
    • v6.2.10
    • v6.2.11
    • v6.2.12
    • v6.2.13
    • v6.2.2
    • v6.2.3
    • v6.2.5
    • v6.2.6
    • v6.2.7
    • v6.2.8
    • v6.3.0
    • v6.3.0-BETA1
    • v6.3.0-BETA2
    • v6.3.0-RC1
    • v6.3.0-RC2
    • v6.3.1
    • v6.3.11
    • v6.3.12
    • v6.3.2
    • v6.3.3
    • v6.3.4
    • v6.3.5
    • v6.3.6
    • v6.3.7
    • v6.3.8
    • v6.4.0
    • v6.4.0-BETA1
    • v6.4.0-BETA2
    • v6.4.0-BETA3
    • v6.4.0-RC1
    • v6.4.2
    • v6.4.3
    • v6.4.4
    • v6.4.5
    • v6.4.6
    • v6.4.7
    • v6.4.8
    • v6.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 6.2.0, < 6.4.10

    Update to 6.4.10

  • symfony/security-bundle Packagist

    Versions
    • v7.0.0
    • v7.0.2
    • v7.0.3
    • v7.0.4
    • v7.0.5
    • v7.0.6
    • v7.0.7
    • v7.0.8
    • v7.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.0.10

    Update to 7.0.10

  • symfony/security-bundle Packagist

    Versions
    • v7.1.0
    • v7.1.1
    • v7.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 7.1.0, < 7.1.3

    Update to 7.1.3

  • symfony/symfony Packagist

    Versions
    • v6.2.0
    • v6.2.1
    • v6.2.10
    • v6.2.11
    • v6.2.12
    • v6.2.13
    • v6.2.14
    • v6.2.2
    • v6.2.3
    • v6.2.4
    • v6.2.5
    • v6.2.6
    • v6.2.7
    • v6.2.8
    • v6.2.9
    • v6.3.0
    • v6.3.0-BETA1
    • v6.3.0-BETA2
    • v6.3.0-BETA3
    • v6.3.0-RC1
    • v6.3.0-RC2
    • v6.3.1
    • v6.3.10
    • v6.3.11
    • v6.3.12
    • v6.3.2
    • v6.3.3
    • v6.3.4
    • v6.3.5
    • v6.3.6
    • v6.3.7
    • v6.3.8
    • v6.3.9
    • v6.4.0
    • v6.4.0-BETA1
    • v6.4.0-BETA2
    • v6.4.0-BETA3
    • v6.4.0-RC1
    • v6.4.0-RC2
    • v6.4.1
    • v6.4.2
    • v6.4.3
    • v6.4.4
    • v6.4.5
    • v6.4.6
    • v6.4.7
    • v6.4.8
    • v6.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 6.2.0, < 6.4.10

    Update to 6.4.10

  • symfony/symfony Packagist

    Versions
    • v7.0.0
    • v7.0.1
    • v7.0.2
    • v7.0.3
    • v7.0.4
    • v7.0.5
    • v7.0.6
    • v7.0.7
    • v7.0.8
    • v7.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.0.10

    Update to 7.0.10

  • symfony/symfony Packagist

    Versions
    • v7.1.0
    • v7.1.1
    • v7.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 7.1.0, < 7.1.3

    Update to 7.1.3

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    Affected ranges
    • ECOSYSTEM: < 6.4.5+dfsg-3ubuntu3+esm1

    Update to 6.4.5+dfsg-3ubuntu3+esm1

Original sources

Check your server →