Update dependency symfony/runtime to 7.4.* [SECURITY]#2625
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency symfony/runtime to 7.4.* [SECURITY]#2625renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
added
bump-patch
|
Terraform plan in ./services/publish/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.publish.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-publish-prod"
!~ last_modified = "2026-05-24T10:40:22.000+0000" -> (known after apply)
!~ source_code_hash = "nPtHlCv5GvI91haJ1WVX0E0hQjIOvJHwe1MTGVLEKBA=" -> "XBUs5eO6EBm8DOYt8sSU2W2HbPmjV6JKFAYHbIqsUpQ="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Publish #2612 |
|
Terraform plan in ./services/orchestrator/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.orchestrator.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-orchestrator-prod"
!~ last_modified = "2026-05-23T00:31:51.000+0000" -> (known after apply)
!~ source_code_hash = "zTTKyMrJYo6V7l718Sq5ruTaJQw1MKOE1FO0WgB+Pnw=" -> "/oweRZp0eZFcyLt7far+JiREVPF0SuUbwc6pz9TAJnQ="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
Warning: Argument is deprecated
with module.event_store.aws_dynamodb_table.event_table,
on event_store/main.tf line 1, in resource "aws_dynamodb_table" "event_table":
1: resource "aws_dynamodb_table" "event_table" {
hash_key is deprecated. Use key_schema instead.
(and one more similar warning elsewhere)
Warning: Deprecated value used
on event_store/outputs.tf line 2, in output "event_table":
2: value = aws_dynamodb_table.event_table
The deprecation originates from module.event_store.aws_dynamodb_table.event_table.global_secondary_index[...].hash_key
hash_key is deprecated. Use key_schema instead.
(and one more similar warning elsewhere)📝 Plan generated in Orchestrator #2412 |
|
Terraform plan in ./services/ingest/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.ingest.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-ingest-prod"
!~ last_modified = "2026-05-24T11:11:01.000+0000" -> (known after apply)
!~ source_code_hash = "uYMcukVKQ5JeVzFnFdrBWDB2iCbmLDYS00Q5mKN5q4U=" -> "zLst/Ijo0Zm0kRbwk+VPPUvyJGmPTFqEhVnaR4nxpng="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Ingest #3366 |
|
Terraform plan in ./services/api/infrastructure in the prod workspace Plan: 0 to add, 3 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.api.aws_lambda_function.api will be updated in-place
!~ resource "aws_lambda_function" "api" {
id = "coverage-api-prod"
!~ last_modified = "2026-05-24T10:40:32.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "7MfLHuOpNPcHbZxnvCS1wWkLFuf5r3zJXoC0gQGK1i0="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
# module.event_listener.aws_lambda_function.events will be updated in-place
!~ resource "aws_lambda_function" "events" {
id = "coverage-api-event-listener-prod"
!~ last_modified = "2026-05-24T10:40:17.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "7MfLHuOpNPcHbZxnvCS1wWkLFuf5r3zJXoC0gQGK1i0="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
# module.webhook_handler.aws_lambda_function.webhooks will be updated in-place
!~ resource "aws_lambda_function" "webhooks" {
id = "coverage-api-webhook-handler-prod"
!~ last_modified = "2026-05-24T10:40:25.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "7MfLHuOpNPcHbZxnvCS1wWkLFuf5r3zJXoC0gQGK1i0="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 3 to change, 0 to destroy.📝 Plan generated in API #3406 |
|
Terraform plan in ./services/analyse/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.analyse.aws_lambda_function.analyse will be updated in-place
!~ resource "aws_lambda_function" "analyse" {
id = "coverage-analyse-prod"
!~ last_modified = "2026-05-24T11:11:14.000+0000" -> (known after apply)
!~ source_code_hash = "XjrPWJz+0Kqjh22CTkk10Hvj82HdnqtZkWAVmnxJFLY=" -> "SitIrgm3d0wE1nq2QuV+LRsJEL5GUyCcLH3ACvHAU3I="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Analyse #3683 |
Coverage Report
Tags
Impacted Files
Last update to d3defb2 at 22:11pm UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.3.*→7.4.*Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-47767 / GHSA-fqc7-9xjw-jrh3
More information
Details
Description
CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an issue where, with
register_argc_argv=On, a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding--env/--no-debugthrough$_SERVER['argv']. The fix shipped insymfony/runtime5.4.46 / 6.4.14 / 7.1.7 gated the argv read onempty($_GET)as a proxy for "is this a CLI invocation".That proxy is unsafe:
parse_str()(which builds$_GET) and the web SAPI (which builds$_SERVER['argv']from the raw query whenregister_argc_argv=On) do not agree on every input, so an attacker can craft a query that leaves$_GETempty while$_SERVER['argv']carries the attacker's flags.SymfonyRuntime::getInput()then parses them, restoring the exact primitive CVE-2024-50340 was meant to prevent.Preconditions and impact match the original CVE: web SAPI,
register_argc_argv=On, app booted throughsymfony/runtime; from an unauthenticated GET an attacker can flipAPP_ENVand toggleAPP_DEBUG.Resolution
SymfonyRuntimenow gates the argv read onisset($_SERVER['QUERY_STRING'])rather than onempty($_GET).QUERY_STRINGis the same input the SAPI uses to build argv, so the security check and the thing it protects no longer parse different sources. Worker SAPIs (FrankenPHP / RoadRunner / Swoole) keep working because the runtime constructor runs once at boot whenQUERY_STRINGis unset.The patch for this issue is available here for branch 5.4.
Credits
SymfonyRuntime would like to thank 0xEr3n for reporting the issue and Nicolas Grekas for providing the fix.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
symfony/runtime (symfony/runtime)
v7.4.12Compare Source
Changelog (symfony/runtime@v7.4.1...v7.4.12)
v7.4.8Compare Source
Changelog (symfony/runtime@v7.4.7...v7.4.8)
v7.4.1Compare Source
Changelog (symfony/runtime@v7.4.0...v7.4.1)
v7.4.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.