GHSA-89r2-5g34-2g47 Symfony Open Redirect

• Packagist symfony/security-http: >= 2.7.38, < 2.7.50 → fixed in 2.7.50 • Packagist symfony/security-http: >= 2.8.0, < 2.8.49 → fixed in 2.8.49 • Packagist symfony/security-http: >= 3.0.0, < 3.4.20 → fixed in 3.4.20 • Packagist symfony/security-http: >= 4.0.0, < 4.0.15 → fixed in 4.0.15 • Packagist symfony/security-http: >= 4.1.0, < 4.1.9 → fixed in 4.1.9 • Packagist symfony/security-http: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Packagist symfony/security: >= 2.7.38, < 2.7.50 → fixed in 2.7.50 • Packagist symfony/security: >= 2.8.0, < 2.8.49 → fixed in 2.8.49 • Packagist symfony/security: >= 3.0.0, < 3.4.19 → fixed in 3.4.19 • Packagist symfony/security: >= 4.0.0, < 4.0.15 → fixed in 4.0.15 • Packagist symfony/security: >= 4.1.0, < 4.1.9 → fixed in 4.1.9 • Packagist symfony/security: >= 4.2.0, < 4.2.1 → fixed in 4.2.1 • Packagist symfony/symfony: >= 2.7.38, < 2.7.50 → fixed in 2.7.50 • Packagist symfony/symfony: >= 2.8.0, < 2.8.49 → fixed in 2.8.49 • Packagist symfony/symfony: >= 3.0.0, < 3.4.20 → fixed in 3.4.20 • Packagist symfony/symfony: >= 4.0.0, < 4.0.15 → fixed in 4.0.15 • Packagist symfony/symfony: >= 4.1.0, < 4.1.9 → fixed in 4.1.9

An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the `_failure_path` input field of login forms, an attacker can work around the redirection target restrictions and effectively redirect the user to any domain after login.