Update dependency symfony/http-kernel to v8.0.12 [SECURITY]#22
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency symfony/http-kernel to v8.0.12 [SECURITY]#22renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
| datasource | package | from | to | | ---------- | ------------------- | ----- | ------ | | packagist | symfony/http-kernel | 8.0.0 | 8.0.12 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
8.0.0→8.0.12Synfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
CVE-2026-45075 / GHSA-6439-2f28-8p8q
More information
Details
Description
Symfony's
#[IsGranted('...')],#[IsSignatureValid], and#[IsCsrfTokenValid(...)]attributes allow you to define amethods: [...]argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute definingmethods: ['GET']would be ignored for aHEADrequest.On the other hand, Symfony's router (and HTTP semantics generally) serves
HEADrequests using theGEThandler. Therefore, a controller protected by e.g.#[IsGranted('ROLE_ADMIN', methods: ['GET'])]can be reached viaHEADwith the authorization check silently skipped.Even if the
HEADrequest won't get any response content, response headers leak (Content-Length,Location, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.Resolution
When adding
GETin themethodsoption of these attributes, Symfony now also include theHEADmethod automatically.The patch for this issue is available here for branch 7.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
symfony/http-kernel (symfony/http-kernel)
v8.0.12Compare Source
Changelog (symfony/http-kernel@v8.0.11...v8.0.12)
IsGranted,IsCsrfTokenValidandIsSignatureValidattributes (@nicolas-grekas)v8.0.11Compare Source
Changelog (symfony/http-kernel@v8.0.10...v8.0.11)
v8.0.10Compare Source
Changelog (symfony/http-kernel@v8.0.8...v8.0.10)
v8.0.8Compare Source
Changelog (symfony/http-kernel@v8.0.7...v8.0.8)
#references in controller arguments (@valtzu)v8.0.7Compare Source
Changelog (symfony/http-kernel@v8.0.6...v8.0.7)
v8.0.6Compare Source
Changelog (symfony/http-kernel@v8.0.5...v8.0.6)
v8.0.5Compare Source
Changelog (symfony/http-kernel@v8.0.4...v8.0.5)
v8.0.4Compare Source
Changelog (symfony/http-kernel@v8.0.3...v8.0.4)
v8.0.3Compare Source
Changelog (symfony/http-kernel@v8.0.2...v8.0.3)
v8.0.2Compare Source
Changelog (symfony/http-kernel@v8.0.1...v8.0.2)
v8.0.1Compare Source
Changelog (symfony/http-kernel@v8.0.0...v8.0.1)
#[Cache]respect all explicit cache directives set in controller (@ayyoub-afwallah)Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.