HighFix available

symfony — security advisory

Type: advisorySources: OSVAdvisory ID: DEBIAN-CVE-2020-5275

In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.

Products: symfony
Affected versions: Not specified
Fixed versions: 4.4.8-1
CVEs: CVE-2020-5275
Confirmed fixed CVEs: Not specified
Updated in this feed: 1 Nov 2026, 13:32 UTC · Revision 1

Source evidence

DEBIAN-CVE-2020-5275

core-osv · Original source

Published 30 Mar 2020, 20:15 UTC

osv:DEBIAN-CVE-2020-5275

symfony

Fixed versions: 4.4.8-1

symfony

Fixed versions: 4.4.8-1

symfony

Fixed versions: 4.4.8-1

Complete source record

{
  "id": "00289586a0af0c260adee6b93e37cbfd8daff7eb02a01b869b75f274d00e4bc4",
  "url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-5275",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "DEBIAN-CVE-2020-5275",
    "summary": "In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.",
    "evidence": "osv:DEBIAN-CVE-2020-5275",
    "products": [
      {
        "name": {
          "value": "symfony",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.4.8-1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "symfony",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.4.8-1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "symfony",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.4.8-1",
            "evidence": "/affected/2/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "DEBIAN-CVE-2020-5275",
      "aliases": [
        "DEBIAN-CVE-2020-5275"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4.4.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "symfony",
            "purl": "pkg:deb/debian/symfony?arch=source&distro=bookworm",
            "ecosystem": "Debian:12"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5275.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4.4.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "symfony",
            "purl": "pkg:deb/debian/symfony?arch=source&distro=trixie",
            "ecosystem": "Debian:13"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5275.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4.4.8-1"
                }
              ]
            }
          ],
          "package": {
            "name": "symfony",
            "purl": "pkg:deb/debian/symfony?arch=source&distro=forky",
            "ecosystem": "Debian:14"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-5275.json"
          },
          "ecosystem_specific": {
            "urgency": "not yet assigned"
          }
        }
      ],
      "modified": "2026-10-26T12:02:32.347978554Z",
      "provider": "osv",
      "upstream": [
        "CVE-2020-5275"
      ],
      "references": [
        "https://security-tracker.debian.org/tracker/CVE-2020-5275"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2020-5275",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 452486,
  "published_at": "2020-03-30T20:15:19.837+00:00"
}