AddToAny

Share this

 

News

11/24/2021 - 11:10

CVE-2021-41268: Remember me cookie persistance after password changes

Description

Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password.

Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.

Resolution

Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.




11/24/2021 - 11:09

CVE-2021-41267: Webcache Poisoning via X-Forwarded-Prefix and sub-request

Description

When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded-* HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks.




11/24/2021 - 11:08

CVE-2021-41270: Prevent CSV Injection via formulas

Description

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with = is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in csv_escape_formulas option in CsvEncoder, to prefix all cells starting by =, +, - or @ by a tab \t.




11/24/2021 - 11:05

Symfony 6.0.0-RC1 released

Symfony 6.0.0-RC1 has just been released. Here is a list of the most
important changes:




11/24/2021 - 10:57

Symfony 5.4.0-RC1 released

Symfony 5.4.0-RC1 has just been released. Here is a list of the most
important changes:




11/24/2021 - 10:50

Symfony 5.3.12 released

Symfony 5.3.12 has just been released. Here is a list of the most
important changes:




11/24/2021 - 10:45

Symfony 4.4.35 released

Symfony 4.4.35 has just been released. Here is a list of the most
important changes:




11/24/2021 - 04:17

Laravel Livewire Calendar Component


Laravel Livewire Calendar is a component to show events in a good looking monthly calendar.
The post Laravel Livewire Calendar Component appeared first on Laravel News.