https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:53:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-08236 bdu:2023-08236 https://cve.radiocsirt.org/vuln/bdu:2023-08236 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0930 certfr-2023-avi-0930 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0930 https://cve.radiocsirt.org/vuln/euvd-2026-161074 EUVD-2026-161074 https://cve.radiocsirt.org/vuln/euvd-2026-161074 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46733 <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-46733 https://cve.radiocsirt.org/vuln/ghsa-m2wj-r6g3-fxfx <p><strong>Affected:</strong> Packagist: symfony/security-http, Packagist: symfony/symfony</p> <p>### Description</p> <p>SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations.</p> <p>### Resolution</p> <p>Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74) for branch 5.4.</p> <p>### Credits</p> <p>We would like to thank Robert Meijers for reporting the issue and providing the fix.</p> <p><strong>Affected:</strong> Packagist: symfony/security-http, Packagist: symfony/symfony</p> <p>### Description</p> <p>SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations.</p> <p>### Resolution</p> <p>Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74) for branch 5.4.</p> <p>### Credits</p> <p>We would like to thank Robert Meijers for reporting the issue and providing the fix.</p> https://cve.radiocsirt.org/vuln/ghsa-m2wj-r6g3-fxfx https://cve.radiocsirt.org/vuln/gsd-2023-46733 gsd-2023-46733 https://cve.radiocsirt.org/vuln/gsd-2023-46733 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46733 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.10: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Ubuntu:24.10: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn&#39;t change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46733