p PatchFirst

PatchFirst · Latest vulnerabilities

symfony/validator vulnerabilities

Vulnerabilities published for symfony/validator in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2024-50343

    Low · CVSS 3.1EPSS 0.46%Fix available

    Incorrect response from Validator when input ends with `\n` in symfony/validator

    symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    symfony/validator symfony/validator symfony/validatorPHP
    • Update to 5.4.43
    • Update to 6.4.11
    • Update to 7.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. GHSA-4vf2-qfg3-7598

    High · CVSS 7.5Fix available

    symfony/validator XML Entity Expansion vulnerability

    Symfony 2.0.11 carried a [similar] XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion (XEE) attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerability is a function of there being no current method of disabling custom entities in PHP (i.e. defined internal to the XML document without using external entities). In a QBA, a long entity can be defined and then referred to multiple times in document elements, creating a memory sink with which Denial Of Service attacks against a host's RAM can be mounted. The use of the LIBXML_NOENT or eq

    symfony/validatorPHP
    • Update to 2.0.17
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →