Description
In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
symfony symfony
>= 4.4.0 and < 4.4.7affected>= 5.0.0 and < 5.0.7affected
References
- https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859 ↗
- https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6 ↗
- https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-header ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/ ↗