CVE-2024-50343

EUVD-2024-3249
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
GitHub_MCNA
3.1 LOW
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Debian logo
Debian Releases
Debian Product
Codename
symfony
bookworm
5.4.23+dfsg-1+deb12u4
fixed
bookworm (security)
5.4.23+dfsg-1+deb12u4
fixed
bullseye
vulnerable
bullseye (security)
4.4.19+dfsg-2+deb11u7
fixed
forky
7.4.2+dfsg-2
fixed
sid
7.4.3+dfsg-1
fixed
trixie
6.4.21+dfsg-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
symfony
bionic
needed
focal
Fixed 4.3.8+dfsg-1ubuntu1+esm2
released
jammy
Fixed 5.4.4+dfsg-1ubuntu8+esm1
released
noble
Fixed 6.4.5+dfsg-3ubuntu3+esm1
released
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needed