Security Digest · Critical advisory (no CVE assigned)
GHSA-mmcv-fvq8-r9x3: Symfony XML decoding attack vector through external entities
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML.
CVSS 9.8 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | symfony/symfony | >= 2.0.0, < 2.0.11 | 2.0.11 |
Details
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system.
CVSS: 9.8 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-mmcv-fvq8-r9x3 github.com
- github.com github.com
- github.com github.com
- symfony.com symfony.com
Critical Composer (PHP) advisories · Today’s Security Digest