Security Issues ¶

Reporting a Security Issue ¶

If you think that you have found a security issue in Symfony, don't use the bug tracker and don't publish it publicly. Instead, all security issues must be sent to security [at] symfony.com. Emails sent to this address are forwarded to the Symfony core team private mailing-list.

The following issues are not considered security issues and should be handled as regular bug fixes (if you have any doubts, don't hesitate to send us an email for confirmation):

• Any security issues found in debug tools that must never be enabled in production (including the web profiler or anything enabled when APP_DEBUG is set to true or APP_ENV set to anything but prod);
  本番環境で有効にしてはならないデバッグ ツールで見つかったセキュリティの問題 (Web プロファイラーや、APP_DEBUG が true に設定されているか、APP_ENV が prod 以外に設定されている場合に有効になるものを含む)。
• Any fix that can be classified as security hardening like route enumeration, login throttling bypasses, denial of service attacks, timing attacks, or lack of SensitiveParameter attributes.
  ルート列挙、ログイン スロットリング バイパス、サービス拒否攻撃、タイミング攻撃、または SensitiveParameter 属性の欠如などのセキュリティ強化として分類できるすべての修正。

In any case, the core team has the final decision on which issues are considered security vulnerabilities.

Security Bug Bounties ¶

Symfony is an Open-Source project where most of the work is done by volunteers. We appreciate that developers are trying to find security issues in Symfony and report them responsibly, but we are currently unable to pay bug bounties.

Resolving Process ¶

For each report, we first try to confirm the vulnerability. When it is confirmed, the core team works on a solution following these steps:

1. Send an acknowledgment to the reporter;
   レポーターに確認を送信します。
2. Work on a patch;
   パッチに取り組みます。
3. Get a CVE identifier from mitre.org;
   mitre.org から CVE 識別子を取得します。

4. Write a security announcement for the official Symfony blog about the vulnerability. This post should contain the following information:

   公式の Symfony ブログに、脆弱性に関するセキュリティ アナウンスを書きます。この投稿には、次の情報が含まれている必要があります。
   • a title that always include the "Security release" string;
     常に「セキュリティ リリース」文字列を含むタイトル。
   • a description of the vulnerability;
     脆弱性の説明;
   • the affected versions;
     影響を受けるバージョン。
   • the possible exploits;
     エクスプロイトの可能性;
   • how to patch/upgrade/workaround affected applications;
     影響を受けるアプリケーションにパッチを適用/アップグレード/回避する方法。
   • the CVE identifier;
     CVE 識別子;
   • credits.
     クレジット。
5. Send the patch and the announcement to the reporter for review;
   パッチとアナウンスをレビューのためにレポーターに送信します。
6. Apply the patch to all maintained versions of Symfony;
   Symfony のすべての保守バージョンにパッチを適用します。
7. Package new versions for all affected versions;
   影響を受けるすべてのバージョンの新しいバージョンをパッケージ化します。
8. Publish the post on the official Symfony blog (it must also be added to the "`Security Advisories`_" category);
   Symfony の公式ブログに投稿を公開します (「セキュリティ アドバイザリ」カテゴリにも追加する必要があります)。
9. Update the public security advisories database maintained by the FriendsOfPHP organization and which is used by the check:security command.
   FriendsOfPHP 組織によって維持され、check:security コマンドによって使用される公安勧告データベースを更新します。

Collaborating with Downstream Open-Source Projects ¶

As Symfony is used by many large Open-Source projects, we standardized the way the Symfony security team collaborates on security issues with downstream projects. The process works as follows:

1. After the Symfony security team has acknowledged a security issue, it immediately sends an email to the downstream project security teams to inform them of the issue;
   Symfony のセキュリティ チームがセキュリティの問題を認識した後、すぐに電子メールを下流のプロジェクト セキュリティ チームに送信して問題を通知します。
2. The Symfony security team creates a private Git repository to ease the collaboration on the issue and access to this repository is given to the Symfony security team, to the Symfony contributors that are impacted by the issue, and to one representative of each downstream projects;
   Symfony セキュリティ チームは、問題に関するコラボレーションを容易にするためにプライベート Git リポジトリを作成します。このリポジトリへのアクセスは、Symfony セキュリティ チーム、問題の影響を受ける Symfony 貢献者、および各ダウンストリーム プロジェクトの 1 人の代表者に与えられます。
3. All people with access to the private repository work on a solution to solve the issue via pull requests, code reviews, and comments;
   プライベート リポジトリにアクセスできるすべての人が、プル リクエスト、コード レビュー、およびコメントを通じて問題を解決するためのソリューションに取り組みます。
4. Once the fix is found, all involved projects collaborate to find the best date for a joint release (there is no guarantee that all releases will be at the same time but we will try hard to make them at about the same time). When the issue is not known to be exploited in the wild, a period of two weeks is considered a reasonable amount of time.
   修正が見つかると、関係するすべてのプロジェクトが協力して、共同リリースの最適な日付を見つけます (すべてのリリースが同時に行われるという保証はありませんが、ほぼ同時に行うように努めます)。問題が実際に悪用されていることが知られていない場合、2 週間の期間が妥当な期間と見なされます。

The list of downstream projects participating in this process is kept as small as possible in order to better manage the flow of confidential information prior to disclosure. As such, projects are included at the sole discretion of the Symfony security team.

As of today, the following projects have validated this process and are part of the downstream projects included in this process:

• Drupal (releases typically happen on Wednesdays)
  Drupal (リリースは通常水曜日に行われます)
• eZPublish
  eZパブリッシュ

Issue Severity ¶

In order to determine the severity of a security issue we take into account the complexity of any potential attack, the impact of the vulnerability and also how many projects it is likely to affect. This score out of 15 is then converted into a level of: Low, Medium, High, Critical, or Exceptional.

Security Advisories ¶

Check the Security Advisories blog category for a list of all security vulnerabilities that were fixed in Symfony releases, starting from Symfony 1.0.0.