Skip to content

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 6, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
symfony/runtime (source) 7.1.1 -> 7.1.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-50340

Description

When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.

Resolution

The SymfonyRuntime now ignores the argv values for non-cli SAPIs PHP runtimes

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.


Release Notes

symfony/runtime (symfony/runtime)

v7.1.7

Compare Source

v7.1.6

Compare Source


Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Amsterdam, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the renovate label Nov 6, 2024
@renovate renovate bot force-pushed the renovate/packagist-symfony-runtime-vulnerability branch from baa8505 to dc82949 Compare November 6, 2024 15:54
@codecov
Copy link

codecov bot commented Nov 6, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.98%. Comparing base (481c201) to head (d3668ea).
Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff            @@
##             master     #913   +/-   ##
=========================================
  Coverage     99.98%   99.98%           
  Complexity     3116     3116           
=========================================
  Files           533      533           
  Lines          9214     9214           
=========================================
  Hits           9213     9213           
  Misses            1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@renovate renovate bot force-pushed the renovate/packagist-symfony-runtime-vulnerability branch from dc82949 to 782efaa Compare November 6, 2024 22:38
@renovate renovate bot force-pushed the renovate/packagist-symfony-runtime-vulnerability branch from 782efaa to d3668ea Compare November 8, 2024 22:47
@frankdekker frankdekker merged commit b3cfc78 into master Nov 9, 2024
5 checks passed
@frankdekker frankdekker deleted the renovate/packagist-symfony-runtime-vulnerability branch November 9, 2024 20:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants