Vulnerability Description
symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sensiolabs | Httpclient | < 5.4.46 |
Related Weaknesses (CWE)
References
- https://github.com/symfony/symfony/commit/296d4b34a33b1a6ca5475c6040b3203622520fPatch
- https://github.com/symfony/symfony/security/advisories/GHSA-9c3x-r3wp-mgxmVendor Advisory
FAQ
What is CVE-2024-50342?
CVE-2024-50342 is a vulnerability with a CVSS score of 3.1 (LOW). symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, som...
How severe is CVE-2024-50342?
CVE-2024-50342 has been rated LOW with a CVSS base score of 3.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-50342?
Check the references section above for vendor advisories and patch information. Affected products include: Sensiolabs Httpclient.