NVD Vulnerability Detail

CVE-2018-14773

Summary	An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
Publication Date	Aug. 4, 2018, 2:29 a.m.
Registration Date	March 1, 2021, 6:57 p.m.
Last Update	Nov. 21, 2024, 12:49 p.m.

Affected software configurations

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:drupal:drupal::::::::		8.0.0			8.5.6

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/104943	Third Party Advisory VDB Entry
2	http://www.securitytracker.com/id/1041405	Third Party Advisory VDB Entry
3	https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b	Issue Tracking Patch Third Party Advisory
4	https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html	Mailing List Third Party Advisory
5	https://seclists.org/bugtraq/2019/May/21	Issue Tracking Mailing List Third Party Advisory
6	https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers	Patch Vendor Advisory
7	https://www.debian.org/security/2019/dsa-4441	Third Party Advisory
8	https://www.drupal.org/SA-CORE-2018-005	Patch Third Party Advisory
9	http://www.securityfocus.com/bid/104943	Third Party Advisory VDB Entry
10	https://www.drupal.org/SA-CORE-2018-005	Patch Third Party Advisory
11	https://www.debian.org/security/2019/dsa-4441	Third Party Advisory
12	https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers	Patch Vendor Advisory
13	https://seclists.org/bugtraq/2019/May/21	Issue Tracking Mailing List Third Party Advisory
14	https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html	Mailing List Third Party Advisory
15	https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b	Issue Tracking Patch Third Party Advisory
16	http://www.securitytracker.com/id/1041405	Third Party Advisory VDB Entry

Common Vulnerabilities List

JVN Vulnerability Information

Symfony におけるデータ処理に関する脆弱性

Title	Symfony におけるデータ処理に関する脆弱性
Summary	Symfony には、データ処理に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 15, 2018, midnight
Registration Date	Nov. 13, 2018, 12:30 p.m.
Last Update	Nov. 13, 2018, 12:30 p.m.

Affected System

Sensio Labs

Symfony 2.7.0 から 2.7.48

Symfony 2.8.0 から 2.8.43

Symfony 3.3.0 から 3.3.17

Symfony 3.4.0 から 3.4.13

Symfony 4.0.0 から 4.0.13

Symfony 4.1.0 から 4.1.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-14773	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14773
National Vulnerability Database (NVD)
2	CVE-2018-14773	https://nvd.nist.gov/vuln/detail/CVE-2018-14773
Symfony
3	CVE-2018-14773: Remove support for legacy and risky HTTP headers	https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-19	https://cwe.mitre.org/data/definitions/19.html

ベンダー情報

No	Name	URL
GitHub
1	[HttpFoundation] Remove support for legacy and risky HTTP headers	https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
Security advisories
2	DRUPAL-SA-CORE-2018-005	https://www.drupal.org/SA-CORE-2018-005

Change Log

No	Changed Details	Date of change
1	[2018年11月13日] 掲載	Nov. 13, 2018, 12:30 p.m.