CVE-2020-15094: 
PHP vulnerability analysis and mitigation

In Symfony before versions 4.4.13 and 5.1.5, a vulnerability was discovered in the CachingHttpClient class from the HttpClient Symfony component. The vulnerability (CVE-2020-15094) was reported and fixed on September 2, 2020. The issue affects the HttpClient component which relies on the HttpCache class to handle requests (GitHub Advisory).

The vulnerability stems from the HttpCache class using internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. While this was initially designed for surrogate caching and ESI support where HTTP calls come from a trusted backend, when used by CachingHttpClient, it creates a security risk. If an attacker can control the response for a request being made by the CachingHttpClient, remote code execution becomes possible (GitHub Advisory).

The vulnerability could allow an attacker who can control the response for a request being made by the CachingHttpClient to achieve remote code execution on the system (GitHub Advisory).

The vulnerability can be exploited when an attacker has control over the response for a request being made by the CachingHttpClient. The exploitation requires the ability to manipulate specific HTTP headers that are used internally by the HttpCache class (GitHub Advisory).

The issue has been fixed in Symfony versions 4.4.13 and 5.1.5. The patch removes headers designed for internal use in HttpCache from remote responses before being passed to HttpCache. Users should upgrade to these versions or later to protect against this vulnerability (GitHub Advisory, Fedora Update).