GHSA-wfv7-5x33-v22h Code injection in the way Symfony implements translation caching in FrameworkBundle

• Packagist symfony/framework-bundle: >= 2.0.0, < 2.3.18 → fixed in 2.3.18 • Packagist symfony/framework-bundle: >= 2.4.0, < 2.4.8 → fixed in 2.4.8 • Packagist symfony/framework-bundle: >= 2.5.0, < 2.5.2 → fixed in 2.5.2 • Packagist symfony/symfony: >= 2.0.0, < 2.3.19 → fixed in 2.3.19 • Packagist symfony/symfony: >= 2.4.0, < 2.4.9 → fixed in 2.4.9 • Packagist symfony/symfony: >= 2.5.0, < 2.5.4 → fixed in 2.5.4

When investigating issue #11093, Jeremy Derussé found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle. • Your Symfony application is vulnerable if you meet the following conditions: • You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a _locale argument for instance): When vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.