CVE-2024-50343

symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CISA-ADPADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Debian logo
Debian Releases
Debian Product
Codename
symfony
bullseye
vulnerable
bookworm
5.4.23+dfsg-1+deb12u4
fixed
bookworm (security)
5.4.23+dfsg-1+deb12u4
fixed
sid
6.4.21+dfsg-2
fixed
trixie
6.4.21+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
symfony
plucky
needs-triage
oracular
needs-triage
noble
Fixed 6.4.5+dfsg-3ubuntu3+esm1
released
jammy
Fixed 5.4.4+dfsg-1ubuntu8+esm1
released
focal
Fixed 4.3.8+dfsg-1ubuntu1+esm2
released
bionic
needed
xenial
needed