You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The PHP 8.0 build fails because GrumPHP task "securitychecker_enlightn" fails, e.g. in the cache PR#157:
[CRITICAL] 1 package has known vulnerabilities
symfony/process (6.0.19)
------------------------
* CVE-2024-51736: CVE-2024-51736: Command execution hijack on Windows with Process class
https://symfony.com/cve-2024-51736
The symfony CVE got fixed in Symfony 5.4.46, 6.4.14, and 7.1.7.
6.4 is not compatible with PHP 8.0, so the older 6.0.19 package gets installed, which still has the bug.
Also, the symfony patch cannot be simply cherry-picked as there are many conflicts.
I see the following options:
Disable GrumPHP security checker
Drop support for PHP 8.0 in aus_driver_amazon_s3
The text was updated successfully, but these errors were encountered:
cweiske
changed the title
Build fails because of symfony/process CVE 2024-51736
PHP 8.0 build fails because of symfony/process CVE 2024-51736
Dec 13, 2024
The PHP 8.0 build fails because GrumPHP task "securitychecker_enlightn" fails, e.g. in the cache PR #157:
The symfony CVE got fixed in Symfony 5.4.46, 6.4.14, and 7.1.7.
6.4 is not compatible with PHP 8.0, so the older 6.0.19 package gets installed, which still has the bug.
Also, the symfony patch cannot be simply cherry-picked as there are many conflicts.
I see the following options:
The text was updated successfully, but these errors were encountered: