CVE-2014-6061: Symfony HttpFoundation Component Authorization Header Parsing Security Issue
Summary
CVE-2014-6061: Symfony has a security issue when parsing the Authorization header. Affects symfony/http-foundation across 3 version ranges.
>= 2.0.0, < 2.3.19
>= 2.4.0, < 2.4.9
>= 2.5.0, < 2.5.4
Fixed in 2.3.19, 2.4.9 or 2.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony HttpFoundation component is a key part of the Symfony framework, providing a set of classes for handling HTTP requests and responses. It is widely used in PHP web applications for processing and manipulating HTTP data. The affected versions of the component include 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X. This vulnerability specifically relates to the parsing of the Authorization header in applications that use HTTP basic or digest authentication.
Vulnerability Detail
The vulnerability arises from the improper parsing of the Authorization header in Symfony. While no known exploits have been demonstrated, certain server setups could potentially be exploited. The issue has been addressed in Symfony versions 2.3.19, 2.4.9, and 2.5.4. The parsing of the Authorization header has been fixed to comply with the HTTP specification.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.192.3.19composer require symfony/http-foundation:2.3.19 -
>= 2.4.0, < 2.4.92.4.9composer require symfony/http-foundation:2.4.9 -
>= 2.5.0, < 2.5.42.5.4composer require symfony/http-foundation:2.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The Symfony HttpFoundation component is vulnerable to an issue related to the parsing of the Authorization header in certain server setups. While no known exploits have been demonstrated, it is crucial to upgrade to the fixed versions (2.3.19, 2.4.9, or 2.5.4) to ensure compliance with the HTTP specification. For further support and assistance in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for symfony/http-foundation →
FAQ
The impact of this vulnerability is dependent on the server setup and the specific usage of HTTP basic or digest authentication in the application. While no known exploits have been demonstrated, it is important to upgrade to the fixed version to ensure compliance with the HTTP specification.
No, only versions 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X of the Symfony HttpFoundation component are affected. Symfony versions outside of this range are not impacted by this specific vulnerability.
Yes, a patch has been provided in the fixed versions of Symfony (2.3.19, 2.4.9, and 2.5.4). It is recommended to upgrade to one of these versions to apply the patch and resolve the vulnerability.
While no specific temporary measures have been suggested, it is important to prioritize upgrading to the fixed version of Symfony as soon as possible to ensure the proper parsing of the Authorization header.
You can find more information about this vulnerability, including the specific affected versions and the patch, in the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-h7v2-2qwg-h829/GHSA-h7v2-2qwg-h829.json
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-foundation.
