UBUNTU-CVE-2021-41267: symfony Ubuntu
Vulnerability summary
UBUNTU-CVE-2021-41267 is a medium (CVSS 6.5) vulnerability in symfony Ubuntu.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 24-11-2021PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- symfonyAll versions (No fix recorded)
1 vendor · 1 product