Symfony 4.4.x < 4.4.7, 5.0.x < 5.0.7 Multiple Vulnerabilities

Symfony is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation;...

CVE-2020-5275

In symfony/security-http before versions 4.4.7 and 5.0.7, when a Firewall checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take...

CVE-2020-5275

In Symfony, the security-http component had a fault in Firewall access checks prior to versions 4.4.7 and 5.0.7 where the system iterated rule attributes and stopped after the first granted attribute, bypassing remaining checks under an unanimous strategy. The issue is resolved by changing the ac...

CVE-2020-5275 Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http

In symfony/security-http before versions 4.4.7 and 5.0.7, when a Firewall checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take...

CVE-2020-5275: All rules set in "access_control" are required when the firewall is configured with the unanimous strategy

More info at https://symfony.com/cve-2020-5275...