Vulnerability · Published Nov 6, 2024 · Assigned by GitHub_M
CVE-2024-50342Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
Low 3.1
In plain English
A low-severity information exposure in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | 5.4.23+dfsg-1+deb12u3 | DSA-5809-1 |
| Debian:12 | symfony | 5.4.23+dfsg-1+deb12u3 | DEBIAN-CVE-2024-50342 |
| Debian:13 | symfony | 6.4.15+dfsg-1 | DEBIAN-CVE-2024-50342 |
| Debian:14 | symfony | 6.4.15+dfsg-1 | DEBIAN-CVE-2024-50342 |
| Packagist | symfony/http-client | 7.1.8 | GHSA-9c3x-r3wp-mgxm |
| Packagist | symfony/http-client | 5.4.47 | GHSA-9c3x-r3wp-mgxm |
| Packagist | symfony/http-client | 6.4.15 | GHSA-9c3x-r3wp-mgxm |
| Packagist | symfony/symfony | 7.1.8 | GHSA-9c3x-r3wp-mgxm |
| Packagist | symfony/symfony | 5.4.47 | GHSA-9c3x-r3wp-mgxm |
| Packagist | symfony/symfony | 6.4.15 | GHSA-9c3x-r3wp-mgxm |
| Ubuntu:25.10 | symfony | no fix listed | UBUNTU-CVE-2024-50342 |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2024-50342 |
| Ubuntu:26.10 | symfony | no fix listed | UBUNTU-CVE-2024-50342 |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N