GHSA-g4rg-rw65-8hfg Symfony Session Fixation Vulnerability

• Packagist symfony/symfony: >= 2.7.0, < 2.7.48 → fixed in 2.7.48 • Packagist symfony/symfony: >= 2.8.0, < 2.8.41 → fixed in 2.8.41 • Packagist symfony/symfony: >= 3.0.0, < 3.3.17 → fixed in 3.3.17 • Packagist symfony/symfony: >= 3.4.0, < 3.4.11 → fixed in 3.4.11 • Packagist symfony/symfony: >= 4.0.0, < 4.0.11 → fixed in 4.0.11 • Packagist symfony/security-http: >= 2.7.0, < 2.7.48 → fixed in 2.7.48 • Packagist symfony/security-http: >= 2.8.0, < 2.8.41 → fixed in 2.8.41 • Packagist symfony/security-http: >= 3.0.0, < 3.3.17 → fixed in 3.3.17 • Packagist symfony/security-http: >= 3.4.0, < 3.4.11 → fixed in 3.4.11 • Packagist symfony/security-http: >= 4.0.0, < 4.0.11 → fixed in 4.0.11 • Packagist symfony/security: >= 2.7.0, < 2.7.48 → fixed in 2.7.48 • Packagist symfony/security: >= 2.8.0, < 2.8.41 → fixed in 2.8.41 • Packagist symfony/security: >= 3.0.0, < 3.3.17 → fixed in 3.3.17 • Packagist symfony/security: >= 3.4.0, < 3.4.11 → fixed in 3.4.11 • Packagist symfony/security: >= 4.0.0, < 4.0.11 → fixed in 4.0.11

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.