security-csrf 2.8 depends on unsupported & vulnerable security-core 3.0 #27507
Description
Symfony version(s) affected: 2.8
Description
Installing version 2.8 of symfony/security-csrf by itself installs an unsupported and vulnerable version of symfony/security-core.
The following line causes composer to prefer the unsupported 3.0 version of symfony/security-core:
The last released version on the 3.0 branch is 3.0.9, which is listed as vulnerable: https://github.com/FriendsOfPHP/security-advisories/blob/e9093b7fc2649d99119cf2540ee6a66471c32480/symfony/security-core/CVE-2018-11407.yaml
How to reproduce
- Start a new project (
composer init) composer require 'symfony/security-csrf:^2.8'
Result:
$ composer require 'symfony/security-csrf:^2.8'
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 6 installs, 0 updates, 0 removals
- Installing symfony/polyfill-util (v1.8.0): Loading from cache
- Installing symfony/polyfill-php56 (v1.8.0): Loading from cache
- Installing symfony/security-core (v3.0.9): Loading from cache
- Installing paragonie/random_compat (v2.0.12): Loading from cache
- Installing symfony/polyfill-php70 (v1.8.0): Loading from cache
- Installing symfony/security-csrf (v2.8.41): Loading from cache
symfony/security-core suggests installing symfony/event-dispatcher ()
symfony/security-core suggests installing symfony/expression-language (For using the expression voter)
symfony/security-core suggests installing symfony/http-foundation ()
symfony/security-core suggests installing symfony/ldap (For using LDAP integration)
symfony/security-core suggests installing symfony/validator (For using the user password constraint)
paragonie/random_compat suggests installing ext-libsodium (Provides a modern crypto API that can be used to generate random bytes.)
symfony/security-csrf suggests installing symfony/http-foundation (For using the class SessionTokenStorage.)
Writing lock file
Generating autoload files
Possible Solution
Loosen the dep to allow any 3.x version or disallow the dep on 3.0, (but that may be backwards breaking.)