symfony/http-client-v6.2.9: 1 vulnerabilities (highest severity is: 3.1)

[mend-bolt-for-github]

Vulnerable Library - symfony/http-client-v6.2.9

Provides powerful methods to fetch HTTP resources synchronously or asynchronously

Library home page: https://api.github.com/repos/symfony/http-client/zipball/7daf5d24c21a683164688b95bb73b7a4bd3b32fc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (symfony/http-client-v6.2.9 version)	Remediation Possible**
CVE-2024-50342	Low	3.1	symfony/http-client-v6.2.9	Direct	symfony/http-client- v5.4.46,v6.4.14,v7.1.7	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-50342

Vulnerable Library - symfony/http-client-v6.2.9

Provides powerful methods to fetch HTTP resources synchronously or asynchronously

Library home page: https://api.github.com/repos/symfony/http-client/zipball/7daf5d24c21a683164688b95bb73b7a4bd3b32fc

Dependency Hierarchy:

• ❌ symfony/http-client-v6.2.9 (Vulnerable Library)

Found in base branch: develop

Vulnerability Details

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the "NoPrivateNetworkHttpClient", some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the "NoPrivateNetworkHttpClient" now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-11-06

URL: CVE-2024-50342

CVSS 3 Score Details (3.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9c3x-r3wp-mgxm

Release Date: 2024-11-06

Fix Resolution: symfony/http-client- v5.4.46,v6.4.14,v7.1.7

Step up your Open Source Security Game with Mend here