CVE-2021-41267

描述

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.

如何修補 CVE-2021-41267

要修補 CVE-2021-41267,請將受影響套件升級到下列已修補版本。

• —升級至 5.3.12 或更新版本
• —升級至 5.3.12 或更新版本

CVE-2021-41267 正在被利用嗎?

低 — EPSS 為 1.2%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 5.2.0, < 5.3.12
• >= 5.2.0, < 5.3.12

CVSS 分數

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-41267
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2021-41267.yaml
• WEBgithub.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41267.yaml
• WEBgithub.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487