An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security. References: https://github.com/symfony/symfony/releases/tag/v4.3.8 https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality https://symfony.com/blog/symfony-4-3-8-released
Created php-symfony tracking bugs for this issue: Affects: epel-all [bug 1775394] Affects: fedora-all [bug 1775393]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.