[Git][security-tracker-team/security-tracker][master] Update information on CVE-2019-18886/symfony

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
be116e88 by Salvatore Bonaccorso at 2019-11-19T19:33:46Z
Update information on CVE-2019-18886/symfony

Versions before 4.1.0 are not affected because the previous versions
asserts "the current user is granted to switch" BEFORE "loading the
user".

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -531,8 +531,13 @@ CVE-2019-18886 [Prevent user enumeration using switch user functionality]
 	RESERVED
 	{DLA-1999-1}
 	- symfony 4.3.8+dfsg-1
+	[buster] - symfony <not-affected> (Vulnerability introduced in 4.1.0)
+	[stretch] - symfony <not-affected> (Vulnerability introduced in 4.1.0)
 	NOTE: https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality
-	NOTE: https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332
+	NOTE: Introduced by: https://github.com/symfony/symfony/commit/6e6ac9eaeec9e6a6cc0ab003cac3738460542b0a (v4.1.0-BETA1)
+	NOTE: Previous versions asserts "the current user is granted to switch" BEFORE
+	NOTE: "loading the user" and thus are not affected.
+	NOTE: Fixed by: https://github.com/symfony/symfony/commit/7bd4a92fc9cc15d9a9fbb9eb1041e01b977f8332 (v4.2.12)
 CVE-2019-18885 (fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verif ...)
 	- linux 5.2.6-1
 	NOTE: https://git.kernel.org/linus/09ba3bc9dd150457c506e4661380a6183af651c1 (5.1-rc1)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/be116e88b0760c40cdb952b0d9e26aece4c0315c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/be116e88b0760c40cdb952b0d9e26aece4c0315c
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20191119/7170f347/attachment.html>