Stay Secure with the Latest Linux Advisories

security advisoryFedoraCSRF issue

Fedora 36: FEDORA-2023-aecde14648 Low Severity: php-symfony4 CSRF Fix

**Version 4.4.50** (2023-02-01) * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login (nicolas-grekas) * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache (nicolas-grekas). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-aecde14648 2023-02-11 01:32:17.846453 --------------------------------------------------------------------------------Name : php-symfony4 Product : Fedora 36 Version : 4.4.50 Release : 1.fc36 URL : https://symfony.com Summary : Symfony PHP framework (version 4) Description : Symfony PHP framework (version 4). NOTE: Does not require PHPUnit bridge. --------------------------------------------------------------------------------Update Information: **Version 4.4.50** (2023-02-01) * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login (nicolas-grekas) * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache (nicolas-grekas) --------------------------------------------------------------------------------ChangeLog: * Thu Feb 2 2023 Remi Collet - 4.4.50-1 - update to 4.4.50 --------------------------------------------------------------------------------References: [ 1 ] Bug #2167258 - CVE-2022-24894 php-symfony: Prevent storing cookie headers in HttpCache https://bugzilla.redhat.com/show_bug.cgi?id=2167258 [ 2 ] Bug #2167261 - CVE-2022-24895 php-symfony: Possible CSRF token fixation https://bugzilla.redhat.com/show_bug.cgi?id=2167261 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-aecde14648' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . The latest update for php-symfony4 on Fedora addresses CSRF token management and header security issues. It is vital to apply these patches promptly to protect your systems. php-symfony4 update,Fedora 36 advisory,CSRF token fix,HttpCache security,Symfony PHP framework. . Severity: Low. LinuxSecurity.com Team

Feb 11, 2023 •Low Fedora