An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

**Version 3.4.35** (2019-11-13)

  - bug #34344 [Console] Constant STDOUT might be undefined     (nicolas-grekas)

  - security #cve-2019-18889 [Cache] forbid serializing     AbstractAdapter and TagAwareAdapter instances     (nicolas-grekas)

  - security #cve-2019-18888 [HttpFoundation] fix guessing     mime-types of files with leading dash (nicolas-grekas)

  - security #cve-2019-18887 [HttpKernel] Use constant time     comparison in UriSigner (stof)

----

**Version 3.4.34** (2019-11-11)

  - bug #34297 [DI] fix locators with numeric keys     (nicolas-grekas)

  - bug #34282 [DI] Dont cache classes with missing parents     (nicolas-grekas)

  - bug #34181 [Stopwatch] Fixed bug in getDuration when     counting multiple ongoing periods (TimoBakx)

  - bug #34179 [Stopwatch] Fixed a bug in     StopwatchEvent::getStartTime (TimoBakx)

  - bug #34203 [FrameworkBundle] [HttpKernel] fixed correct     EOL and EOM month (erics86)

----

**Version 3.4.33** (2019-11-01)

  - bug #33998 [Config] Disable default alphabet sorting in     glob function due of unstable sort (hurricane-voronin)

  - bug #34144 [Serializer] Improve messages for unexpected     resources values (fancyweb)

  - bug #34080 [SecurityBundle] correct types for default     arguments for firewall configs (shieldo)

  - bug #33999 [Form] Make sure to collect child forms     created on *_SET_DATA events (yceruto)

  - bug #34021 [TwigBridge] do not render errors for     checkboxes twice (xabbuh)

  - bug #34041 [HttpKernel] fix wrong removal of the just     generated container dir (nicolas-grekas)

  - bug #34023 [Dotenv] allow LF in single-quoted strings     (nicolas-grekas)

  - bug #33818 [Yaml] Throw exception for tagged invalid     inline elements (gharlan)

  - bug #33948 [PropertyInfo] Respect property name case     when guessing from public method name (antograssiot)

  - bug #33962 [Cache] fixed TagAwareAdapter returning     invalid cache (v-m-i)

  - bug #33965 [HttpFoundation] Add plus character `+` to     legal mime subtype (ilzrv)

  - bug #32943 [Dotenv] search variable values in ENV first     then env file (soufianZantar)

  - bug #33943 [VarDumper] fix resetting the 'bold' state in     CliDumper (nicolas-grekas)

----

**Version 3.4.32** (2019-10-07)

  - bug #33834 [Validator] Fix ValidValidator group     cascading usage (fancyweb)

  - bug #33841 [VarDumper] fix dumping uninitialized     SplFileInfo (nicolas-grekas)

  - bug #33799 [Security]: Don't let falsy usernames slip     through impersonation (j4nr6n)

  - bug #33814 [HttpFoundation] Check if data passed to     SessionBagProxy::initialize is an array (mynameisbogdan)

  - bug #33805 [FrameworkBundle] Fix wrong returned status     code in ConfigDebugCommand (jschaedl)

  - bug #33781 [AnnotationCacheWarmer] add     RedirectController to annotation cache (jenschude)

  - bug #33777 Fix the :only-of-type pseudo class selector     (jakzal)

  - bug #32051 [Serializer] Add CsvEncoder tests for PHP 7.4     (ro0NL)

  - feature #33776 Copy phpunit.xsd to a predictable path     (julienfalque)

  - bug #33759 [Security/Http] fix parsing X509 emailAddress     (nicolas-grekas)

  - bug #33733 [Serializer] fix denormalization of     string-arrays with only one element (mkrauser)

  - bug #33754 [Cache] fix known tag versions ttl check     (SwenVanZanten)

  - bug #33646 [HttpFoundation] allow additinal characters     in not raw cookies (marie)

  - bug #33748 [Console] Do not include hidden commands in     suggested alternatives (m-vo)

  - bug #33625 [DependencyInjection] Fix wrong exception     when service is synthetic (k0d3r1s)

  - bug #32522 [Validator] Accept underscores in the URL     validator, as the URL will load (battye)

  - bug #32437 Fix toolbar load when GET params are present     in '_wdt' route (Molkobain)

  - bug #32925 [Translation] Collect original locale in case     of fallback translation (digilist)

  - bug #31198 [FrameworkBundle] Fix framework bundle lock     configuration not working as expected (HypeMC)

  - bug #33719 [Cache] dont override native Memcached     options (nicolas-grekas)

  - bug #33675 [PhpUnit] Fix usleep mock return value     (fabpot)

  - bug #33618 fix tests depending on other components'     tests (xabbuh)

  - bug #33626 [PropertyInfo] ensure compatibility with type     resolver 0.5 (xabbuh)

  - bug #33620 [Twig] Fix Twig config extra keys (fabpot)

  - bug #33571 [Inflector] add support 'see' to 'ee' for     singularize 'fees' to 'fee' (maxhelias)

  - bug #32763 [Console] Get dimensions from stty on windows     if possible (rtek)

  - bug #33518 [Yaml] don't dump a scalar tag value on its     own line (xabbuh)

  - bug #32818 [HttpKernel] Fix getFileLinkFormat() to avoid     returning the wrong URL in Profiler (Arman-Hosseini)

  - bug #33487 [HttpKernel] Fix Apache mod_expires Session     Cache-Control issue (pbowyer)

  - bug #33439 [Validator] Sync string to date behavior and     throw a better exception (fancyweb)

  - bug #32903 [PHPUnit Bridge] Avoid registering listener     twice (alexpott)

  - bug #33402 [Finder] Prevent unintentional file locks in     Windows (jspringe)

  - bug #33396 Fix #33395 PHP 5.3 compatibility     (kylekatarnls)

  - bug #33385 [Console] allow Command::getName() to return     null (nicolas-grekas)

  - bug #33353 Return null as Expire header if it was set to     null (danrot)

  - bug #33382 [ProxyManager] remove     ProxiedMethodReturnExpression polyfill (nicolas-grekas)

  - bug #33377 [Yaml] fix dumping not inlined scalar tag     values (xabbuh)

----

**Version 3.4.31** (2019-08-26)

  - bug #33335 [DependencyInjection] Fixed the     `getServiceIds` implementation to always return aliases     (pdommelen)

  - bug #33244 [Router] Fix TraceableUrlMatcher behaviour     with trailing slash (Xavier Leune)

  - bug #33172 [Console] fixed a PHP notice when there is no     function in the stack trace of an Exception (fabpot)

  - bug #33157 Fix getMaxFilesize() returning zero (ausi)

  - bug #33139 [Intl] Cleanup unused language aliases entry     (ro0NL)

  - bug #33066 [Serializer] Fix negative DateInterval     (jderusse)

  - bug #33033 [Lock] consistently throw NotSupportException     (xabbuh)

  - bug #32516 [FrameworkBundle][Config] Ignore exceptions     thrown during reflection classes autoload (fancyweb)

  - bug #32981 Fix tests/code for php 7.4 (jderusse)

  - bug #32992 [ProxyManagerBridge] Polyfill for     unmaintained version (jderusse)

  - bug #32933 [PhpUnitBridge] fixed PHPUnit 8.3     compatibility: method handleError was renamed to
    __invoke (karser)

  - bug #32947 [Intl] Support DateTimeInterface in     IntlDateFormatter::format (pierredup)

  - bug #32838 [FrameworkBundle] Detect indirect env vars in     routing (ro0NL)

  - bug #32918 [Intl] Order alpha2 to alpha3 mapping (ro0NL)

  - bug #32902 [PhpUnitBridge] Allow sutFqcnResolver to     return array (VincentLanglet)

  - bug #32682 [HttpFoundation] Revert getClientIp @return     docblock (ossinkine)

  - bug #32910 [Yaml] PHP-8: Uncaught TypeError: abs()     expects parameter 1 to be int or float, string given     (Aleksandr Dankovtsev)

  - bug #32870 #32853 Check if $this->parameters is array.
    (ABGEO07)

  - bug #32868 [PhpUnitBridge] Allow symfony/phpunit-bridge     > 4.2 to be installed with phpunit 4.8 (jderusse)

  - bug #32767 [Yaml] fix comment in multi line value     (soufianZantar)

  - bug #32790 [HttpFoundation] Fix `getMaxFilesize`     (bennyborn)

  - bug #32796 [Cache] fix warning on PHP 7.4 (jpauli)

  - bug #32806 [Console] fix warning on PHP 7.4 (rez1dent3)

  - bug #32809 Don't add object-value of static properties     in the signature of container metadata-cache (arjenm)

  - bug #30096 [DI] Fix dumping Doctrine-like service graphs     (bis) (weaverryan, nicolas-grekas)

  - bug #32799 [HttpKernel] do not stopwatch sections when     profiler is disabled (Tobion)

----

**Packaging changes**

  - One distinct autoloader for each component.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a timing attack/information leak, argument injection and code execution via unserialization.

ID	Name	Product	Family	Severity
131202	Fedora 31 : php-symfony3 (2019-8b0ba02338)	Nessus	Fedora Local Security Checks	critical
131141	Debian DSA-4573-1 : symfony - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-18889

critical

Tenable Plugins

critical

critical