Debian: DLA-3493-1 Critical Advisory on Symfony Impersonation Risks

CVE-2021-21424

James Isaac, Mathias Brodala and Laurent Minguet discovered that it
was possible to enumerate users without relevant permissions due to
different exception messages depending on whether the user existed
or not. It was also possible to enumerate users by using a timing
attack, by comparing time elapsed when authenticating an existing
user and authenticating a non-existing user.

403s are now returned whether the user exists or not if a user
cannot switch to a user or if the user does not exist.

CVE-2022-24894

Soner Sayakci discovered that when the Symfony HTTP cache system is
enabled, the response header might be stored with a `Set-Cookie`
header and returned to some other clients, thereby allowing an
attacker to retrieve the victim's session.

The `HttpStore` constructor now takes a parameter containing a list
of private headers that are removed from the HTTP response headers.