Affected versions¶ Symfony >= 5.3.0, <5.3.2 versions of the Symfony Security HTTP component is affected by this security issue. The issue has been fixed in Symfony 5.3.2. Description¶ When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application. We now ensure that the authenticated token is only available for the firewall that generates it. The patch for this issue is available here for branch 5.3. Credits¶ I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Sponsor the Symfony project.Chcete-li přidat komentář, přihlaste se
Ostatní příspěvky v této skupině
This week, the upcoming Symfony 7.3 version improved the AsAlias attribute by adding a new argument, introduced Clock support for UriSigner, and refined the return type of the ContainerInterface::get(
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
SymfonyLive Paris 2025 took place three weeks ago — a big thank you to everyone who joined us! The conference was held entirely in French, and now you can relive the best moments: replays, hig
This week, Symfony 7.3 entered its "feature freeze" period in preparation for its release at the end of May 2025. Development activity focused on refining and polishing its new features, including a n
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
The international Symfony conference of the year, SymfonyCon Amsterdam 2025, will take place in the Netherlands on November 27 & 28, 2025!
⏳ Early bird registration ends this Wednesday! D
This week, the upcoming Symfony 7.3 version entered its feature freeze period to tweak and polish its new features before releasing it at the end of May 2025. In addition, we celebrated the SymfonyLiv
