Nicolas-Grekas

**Name of the Vulnerable Software and Affected Versions** Symfony versions prior to 4.2.12 Symfony versions 4.3.x prior to 4.3.8 **Description** An issue in the VarExport component of Symfony allows specially crafted strings to escalate to the execution of arbitrary PHP code due to incorrect string escaping. This issue is related to the symfony/var-exporter component. **Recommendations** For Symfony versions prior to 4.2.12, update to version 4.2.12 or later. For Symfony versions 4.3.x prior to 4.3.8, update to version 4.3.8 or later.

**Name of the Vulnerable Software and Affected Versions** Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7 **Description** An issue was discovered that allows the enumeration of users due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This issue is related to symfony/security. **Recommendations** For Symfony versions 4.2.0 through 4.2.11, update to a version outside of this range to resolve the issue. For Symfony versions 4.3.0 through 4.3.7, update to a version outside of this range to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Symfony versions 2.8.0 through 2.8.50 Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7 **Description** An issue was discovered where an application passes unvalidated user input as the file for which MIME type validation should occur, allowing arbitrary arguments to be passed to the underlying file command. This issue is related to symfony/http-foundation and symfony/mime in 4.3.x. The vulnerability can be exploited by a remote attacker to impact data integrity. **Recommendations** For Symfony versions 2.8.0 through 2.8.50, update to a version outside of this range to resolve the issue. For Symfony versions 3.4.0 through 3.4.34, update to a version outside of this range to resolve the issue. For Symfony versions 4.2.0 through 4.2.11, update to a version outside of this range to resolve the issue. For Symfony versions 4.3.0 through 4.3.7, update to a version outside of this range to resolve the issue. As a temporary workaround, consider validating user input before passing it as the file for MIME type validation to prevent arbitrary arguments from being passed to the underlying file command.

**Name of the Vulnerable Software and Affected Versions** Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7 **Description** The issue exists due to the failure to neutralize special elements, which can allow a remote attacker to inject arbitrary code. This is related to the serialization of certain cache adapter interfaces in Symfony, potentially resulting in remote code injection. **Recommendations** For Symfony versions 3.4.0 through 3.4.34, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.2.0 through 4.2.11, update to a version that fixes the issue with serializing cache adapter interfaces. For Symfony versions 4.3.0 through 4.3.7, update to a version that fixes the issue with serializing cache adapter interfaces.