GHSA-3r8j-pmch-5j2h Internal exception message exposure for login action in Sylius

• Packagist sylius/sylius: < 1.3.14 → fixed in 1.3.14 • Packagist sylius/sylius: >= 1.4.0, < 1.4.10 → fixed in 1.4.10 • Packagist sylius/sylius: >= 1.5.0, < 1.5.7 → fixed in 1.5.7 • Packagist sylius/sylius: >= 1.6.0, < 1.6.3 → fixed in 1.6.3

Internal exception message exposure for login action Impact Exception messages from internal exceptions (like database exception) are wrapped by `\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. Patches _Has the problem been patched? What versions should users upgrade to?_ Workarounds The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with ```twig {% if last_error %} {{ messages.error(last_error.messageKey) }} {% endif %} ``` The `messageKey` field should be used instead of the `message`.