CVE-2020-15094

描述

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

如何修補 CVE-2020-15094

要修補 CVE-2020-15094,請將受影響套件升級到下列已修補版本。

• —升級至 4.4.13 或更新版本
• —升級至 4.4.13 或更新版本

CVE-2020-15094 正在被利用嗎?

低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 4.3.0, < 4.4.13
• >= 4.3.0, < 4.4.13

CVSS 分數

參考連結(11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-15094
• PATCHgithub.com/symfony/symfony
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2020-15094.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-15094.yaml