On Symfony before 4.4.0, when a Firewall
checks an access control rule (using the unanimous strategy), it iterates over all rule attributes and grant access only if all calls to the accessDecisionManager
decide to grant access.
As of Symfony 4.4.0, a bug was introduced that prevents the check of attributes as soon as accessDecisionManager
decide to grant access on one attribute.
The accessDecisionManager
is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute.
The patch for this issue is available here for the 4.4 branch.
I would like to thank Antonio J. GarcΓa Lagar for reporting & Robin Chalas for fixing the issue.
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2020-5275.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2020-5275.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-5275.yaml
github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf
github.com/symfony/symfony/security/advisories/GHSA-g4m9-5hpf-hx72
lists.fedoraproject.org/archives/list/[email protected]/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ
nvd.nist.gov/vuln/detail/CVE-2020-5275
symfony.com/cve-2020-5275