GHSA-4vf2-qfg3-7598 high
symfony/validator XML Entity Expansion vulnerability
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.0.17>=2.0.0,<2.0.17Fixed versions: 2.0.17
Vulnerability intelligence Composer
symfony/validator
Provides tools to validate values
Composer latest 8.1.7 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
8.1.7
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
3 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-q8j7-fjh7-25v5 high
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Affected range
ECOSYSTEM: introduced 2.0.0; fixed 2.0.24ECOSYSTEM: introduced 2.1.0; fixed 2.1.12ECOSYSTEM: introduced 2.2.0; fixed 2.2.5ECOSYSTEM: introduced 2.3.0; fixed 2.3.3>=2.0.0,<2.0.24|>=2.1.0,<2.1.12|>=2.2.0,<2.2.5|>=2.3.0,<2.3.3Fixed versions: 2.0.24, 2.1.12, 2.2.5, 2.3.3
Symfony has an incorrect response from Validator when input ends with `\n`
Affected range
ECOSYSTEM: introduced 0; fixed 5.4.43ECOSYSTEM: introduced 6.0.0; fixed 6.4.11ECOSYSTEM: introduced 7.0.0; fixed 7.1.4>=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.43|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.11|>=7.0.0,<7.1.0|>=7.1.0,<7.1.4Fixed versions: 5.4.43, 6.4.11, 7.1.4