https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:34:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336748 EUVD-2026-336748 https://cve.radiocsirt.org/vuln/euvd-2026-336748 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45063 <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER[&#39;SSL_CLIENT_S_DN&#39;] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER[&#39;SSL_CLIENT_S_DN&#39;] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-45063 https://cve.radiocsirt.org/vuln/ghsa-ph86-p8f6-f9r2 <p><strong>Affected:</strong> Packagist: symfony/security-http, Packagist: symfony/symfony</p> <p>### Description</p> <p>`X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client&#39;s certificate against a trusted CA, then passes the certificate&#39;s Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,emailAddress=alice@example.com`) to Symfony via `$_SERVER[&#39;SSL_CLIENT_S_DN&#39;]`. Symfony extracts the user identifier from that string.</p> <p>The extraction uses an **unanchored** regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggle `emailAddress=victim@target` inside the CN value and be authenticated as the victim.</p> <p>### Resolution</p> <p>The `X509Authenticator` now uses a regex that anchors the match to an RDN boundary (start of string, or following a `,` / `/` separator).</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/ccb3f724c7ff55670a6fe3521c7bf1514cceb478) for branch 5.4.</p> <p>### Credits</p> <p>Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.</p> <p><strong>Affected:</strong> Packagist: symfony/security-http, Packagist: symfony/symfony</p> <p>### Description</p> <p>`X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client&#39;s certificate against a trusted CA, then passes the certificate&#39;s Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,emailAddress=alice@example.com`) to Symfony via `$_SERVER[&#39;SSL_CLIENT_S_DN&#39;]`. Symfony extracts the user identifier from that string.</p> <p>The extraction uses an **unanchored** regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggle `emailAddress=victim@target` inside the CN value and be authenticated as the victim.</p> <p>### Resolution</p> <p>The `X509Authenticator` now uses a regex that anchors the match to an RDN boundary (start of string, or following a `,` / `/` separator).</p> <p>The patch for this issue is available [here](https://github.com/symfony/symfony/commit/ccb3f724c7ff55670a6fe3521c7bf1514cceb478) for branch 5.4.</p> <p>### Credits</p> <p>Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.</p> https://cve.radiocsirt.org/vuln/ghsa-ph86-p8f6-f9r2 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45063 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER[&#39;SSL_CLIENT_S_DN&#39;] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: symfony, Ubuntu:Pro:18.04:LTS: symfony, Ubuntu:Pro:20.04:LTS: symfony, Ubuntu:Pro:22.04:LTS: symfony, Ubuntu:Pro:24.04:LTS: symfony, Ubuntu:25.10: symfony, Ubuntu:26.04:LTS: symfony</p> <p>Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER[&#39;SSL_CLIENT_S_DN&#39;] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45063