GitHub Advisoryadvisory · Packagist

GHSA-g3rh-rrhp-jhh9 Symfony has an incorrect response from Validator when input ends with `\n`

LOW Published 2024-11-06 Modified 2025-11-03 Official page ↗
Aliases
CVE-2024-50343
Ecosystem
Packagist
Packages
symfony/symfony, symfony/validator
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2024-11-06

Affected packages

• Packagist symfony/symfony: < 5.4.43 → fixed in 5.4.43 • Packagist symfony/symfony: >= 6.0.0, < 6.4.11 → fixed in 6.4.11 • Packagist symfony/symfony: >= 7.0.0, < 7.1.4 → fixed in 7.1.4 • Packagist symfony/validator: < 5.4.43 → fixed in 5.4.43 • Packagist symfony/validator: >= 6.0.0, < 6.4.11 → fixed in 6.4.11 • Packagist symfony/validator: >= 7.0.0, < 7.1.4 → fixed in 7.1.4

Description

Description It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Resolution Symfony now uses the `D` regex modifier to match the entire input. The patch for this issue is available here for branch 5.4. Credits We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.

Related

Alias · CVE (1)

  • CVE-2024-50343 symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References