{"id":"UBUNTU-CVE-2021-41267","details":"Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the \"trusted_headers\" allowed list are ignored and protect users from \"Cache poisoning\" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the \"trusted_headers\" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.","modified":"2026-02-04T17:16:53.952424Z","published":"2021-11-24T19:15:00Z","withdrawn":"2025-06-23T15:54:06Z","related":["CVE-2021-41267"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-41267"},{"type":"REPORT","url":"https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q"},{"type":"REPORT","url":"https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487"},{"type":"REPORT","url":"https://github.com/symfony/symfony/releases/tag/v5.3.12"},{"type":"REPORT","url":"https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487"},{"type":"REPORT","url":"https://github.com/symfony/symfony/pull/44243"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-41267"}],"affected":[{"package":{"name":"symfony","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/symfony@5.4.4+dfsg-1ubuntu8?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.6+dfsg-1ubuntu7","5.4.4+dfsg-1ubuntu8"],"ecosystem_specific":{"ubuntu_priority":"medium"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41267.json"}},{"package":{"name":"symfony","ecosystem":"Ubuntu:24.10","purl":"pkg:deb/ubuntu/symfony@6.4.10+dfsg-1ubuntu1?arch=source&distro=oracular"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.5+dfsg-3ubuntu3","6.4.10+dfsg-1ubuntu1"],"ecosystem_specific":{"ubuntu_priority":"medium"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41267.json"}},{"package":{"name":"symfony","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/symfony@6.4.5+dfsg-3ubuntu3?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.23+dfsg-1ubuntu1","5.4.35+dfsg-3ubuntu1","6.4.5+dfsg-3ubuntu2","6.4.5+dfsg-3ubuntu3"],"ecosystem_specific":{"ubuntu_priority":"medium"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-41267.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}