Update dependency symfony/security-bundle to v5.4.20 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/security-bundle (source)	5.4.9 → 5.4.20

---

Symfony vulnerable to Session Fixation of CSRF tokens

CVE-2022-24895 / GHSA-3gv2-29qc-v67m

More information

Details

Description

When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Resolution

Symfony removes all CSRF tokens from the session on successful login.

The patch for this issue is available here for branch 4.4.

Credits

We would like to thank Marco Squarcina for reporting the issue and Nicolas Grekas for fixing it.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

• https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24895.yaml
• https://symfony.com/cve-2022-24895
• https://nvd.nist.gov/vuln/detail/CVE-2022-24895
• https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946
• https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4
• https://lists.debian.org/debian-lts-announce/2023/07/msg00014.html
• https://github.com/advisories/GHSA-3gv2-29qc-v67m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/security-bundle (symfony/security-bundle)

v5.4.20

Compare Source

Changelog (symfony/security-bundle@v5.4.19...v5.4.20)

• no significant changes

v5.4.19

Compare Source

Changelog (symfony/security-bundle@v5.4.18...v5.4.19)

• bug #​48937 Fix using same handler for multiple authenticators (RobertMe)

v5.4.17

Compare Source

Changelog (symfony/security-bundle@v5.4.16...v5.4.17)

• bug #​48718 Compatibility with doctrine/annotations 2 (derrabus)
• bug #​48615 Fix getting the name of closures on PHP 8.1.11+ (nicolas-grekas)

v5.4.11

Compare Source

Changelog (symfony/security-bundle@v5.4.10...v5.4.11)

• no significant changes

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.