Stay Secure with the Latest Linux Advisories

security advisoryFedoraCSRF

Fedora 37: FEDORA-2023-74b702f058 Moderate: php-symfony HTTP Enhancements

**Version 4.4.50** (2023-02-01) * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login (nicolas-grekas) * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache (nicolas-grekas). --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-74b702f058 2023-02-11 00:31:14.452873 --------------------------------------------------------------------------------Name : php-symfony4 Product : Fedora 37 Version : 4.4.50 Release : 1.fc37 URL : https://symfony.com Summary : Symfony PHP framework (version 4) Description : Symfony PHP framework (version 4). NOTE: Does not require PHPUnit bridge. --------------------------------------------------------------------------------Update Information: **Version 4.4.50** (2023-02-01) * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login (nicolas-grekas) * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache (nicolas-grekas) --------------------------------------------------------------------------------ChangeLog: * Thu Feb 2 2023 Remi Collet - 4.4.50-1 - update to 4.4.50 --------------------------------------------------------------------------------References: [ 1 ] Bug #2167258 - CVE-2022-24894 php-symfony: Prevent storing cookie headers in HttpCache https://bugzilla.redhat.com/show_bug.cgi?id=2167258 [ 2 ] Bug #2167261 - CVE-2022-24895 php-symfony: Possible CSRF token fixation https://bugzilla.redhat.com/show_bug.cgi?id=2167261 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-74b702f058' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . The latest release for php-symfony4 enhances security measures by refining CSRF token handling and optimizing header retention.. php-symfony, security advisory, Fedora updates, CSRF management. . LinuxSecurity.com Team

Feb 11, 2023 Fedora