Recent searches
Search options
Someone has created bogus CVE reports for Symfony (CVE-2024-36611 and CVE-2024-36610).
You might experience warnings from `composer audit` or other tools about these bogus CVEs when using Symfony components <7.1.
These MUST BE IGNORED, the reports are NOT security issues.
We're trying to find out how we can solve this. If someone has experience with this, please let us know!
@wouterj Mautic became a CNA for this reason, there's a bit of training involved and processes to follow but it's minimal really, and perfectly manageable if you've got an existing security team.
@rcheesley thank you for the suggestion! We've started investigating this path today.
Aside: I'm a bit sad that OSS projects have to go through lengths like this to protect their users.
@wouterj yeah indeed, happy to chat if it's any help, we signed up a few years back now.