Ubuntu 20

tenable:216425 is not one bug; it is Ubuntu's February 18, 2025 rollup for multiple Symfony issues in the php-symfony source package (USN-7272-1). The meaningful items range from query-string-driven environment/debug tampering (CVE-2024-50340) to programmatic login bypass edge cases (CVE-2024-50341) and remember-me cookie auth bypass (CVE-2024-51996), plus lower-impact information leaks, open redirect, XSS, and CSRF bugs. Ubuntu fixed these in 24.04 LTS: 6.4.5+dfsg-3ubuntu3+esm1, 22.04 LTS: 5.4.4+dfsg-1ubuntu8+esm1, and 20.04 LTS: 4.3.8+dfsg-1ubuntu1+esm2, with several of the newer CVEs affecting only 22.04/24.04 or only 24.04.

Tenable labels the plugin HIGH, and if someone told you this was CRITICAL, that's overstated. The real-world story is that exploitation is highly app- and configuration-dependent: you need a live Symfony application, the relevant component in use, and often a specific deployment choice like register_argc_argv=On, remember-me persistence, or custom programmatic login flows. There is no KEV listing, no broad exploitation signal, and no generic one-request RCE here.

Why this verdict

• Downgrade: package presence is not reachable exposure. Tenable proves Ubuntu package state, not that the host is serving an exploitable Symfony route to attackers.
• Downgrade: multiple prerequisites stack. Real attacks need a live Symfony application plus the affected component plus a specific pattern such as register_argc_argv=On, programmatic Security::login, or persisted remember-me cookies.
• Downgrade: blast radius is usually application-scoped. Most paths yield auth bypass, info leak, redirect abuse, or debug/env manipulation inside one app, not turnkey host-level code execution.
• Downgrade: affected population narrows by release. Some of the most interesting CVEs do not affect 20.04, and some were only addressed for 24.04, which sharply limits broad fleet risk.
• Downgrade: no exploitation evidence. Current review found no KEV entry and no strong public campaign signal that would force an urgent threat-driven upgrade.

Why not higher?

This does not earn HIGH or CRITICAL because there is no universal pre-auth RCE path and no evidence that an unauthenticated internet attacker can reliably convert the plugin hit into host compromise across normal Ubuntu deployments. The chain is app-aware and conditional, which is exactly the kind of friction CVSS overstates when you manage 10,000 hosts.

Why not lower?

I would not drop this to LOW or IGNORE because some members of the bundle can still meaningfully weaken exposed production apps. In particular, runtime environment/debug tampering and remember-me or programmatic-login auth issues can create real business impact when they land on an internet-facing Symfony service.

1. Prioritize exposed Symfony apps first — Triage this finding by internet reachability and app role, not by raw Ubuntu package count. For a MEDIUM verdict there is no mitigation SLA, but you should still front-load externally exposed Symfony services and admin portals before internal-only or build hosts.
2. Turn off register_argc_argv where feasible — This specifically cuts risk from CVE-2024-50340 on affected 22.04/24.04 web stacks. Validate PHP runtime defaults and deploy the config change during normal change control if your application does not require argv parsing.
3. Review remember-me and programmatic login usage — Check whether the application actually uses persisted remember-me cookies or Security::login with custom user checkers. If those features are absent, your reachable risk collapses even if the package scanner still fires.
4. Harden edge logging and alerting — Add detections for odd query-string switches, unusual redirect targets, and remember-me cookie anomalies so exploitation attempts are visible while you work through remediation. For MEDIUM, this is hygiene rather than an emergency control.

Run this on the target Ubuntu host with a regular shell; sudo is only needed if your environment restricts dpkg-query or /etc/os-release. Example: bash verify_symfony_usn7272.sh. The script checks installed php-symfony* packages against the Ubuntu fixed versions for 20.04, 22.04, and 24.04 and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# verify_symfony_usn7272.sh
# Check Ubuntu USN-7272-1 (Symfony vulnerabilities) package state.
# Exit codes:
#   0 = PATCHED / not installed
#   1 = VULNERABLE
#   2 = UNKNOWN / unsupported environment

set -u

status_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

status_vuln() {
  echo "VULNERABLE: $1"
  exit 1
}

status_patched() {
  echo "PATCHED: $1"
  exit 0
}

if [[ ! -r /etc/os-release ]]; then
  status_unknown "/etc/os-release not readable"
fi

# shellcheck disable=SC1091
source /etc/os-release

release="${VERSION_ID:-}"
case "$release" in
  "24.04") fixed="6.4.5+dfsg-3ubuntu3+esm1" ;;
  "22.04") fixed="5.4.4+dfsg-1ubuntu8+esm1" ;;
  "20.04") fixed="4.3.8+dfsg-1ubuntu1+esm2" ;;
  *) status_unknown "Unsupported Ubuntu release: ${release:-unknown}" ;;
esac

if ! command -v dpkg-query >/dev/null 2>&1; then
  status_unknown "dpkg-query not found"
fi

# Collect installed binary packages built from the php-symfony source package naming pattern.
mapfile -t pkgs < <(dpkg-query -W -f='${db:Status-Abbrev}\t${Package}\t${Version}\n' 'php-symfony*' 2>/dev/null | awk '$1 ~ /^ii/ {print $2 "\t" $3}')

if [[ ${#pkgs[@]} -eq 0 ]]; then
  status_patched "No installed php-symfony* packages found"
fi

vuln_found=0
report=""
for line in "${pkgs[@]}"; do
  pkg="${line%%$'\t'*}"
  ver="${line#*$'\t'}"

  if dpkg --compare-versions "$ver" lt "$fixed"; then
    vuln_found=1
    report+="$pkg=$ver (< $fixed); "
  else
    report+="$pkg=$ver (>= $fixed); "
  fi
done

if [[ $vuln_found -eq 1 ]]; then
  status_vuln "USN-7272-1 threshold for Ubuntu $release is $fixed. $report"
else
  status_patched "All installed php-symfony* packages meet or exceed $fixed for Ubuntu $release. $report"
fi

Sources

1. Tenable Nessus Plugin 216425
2. Ubuntu USN-7272-1
3. Ubuntu CVE-2024-50340
4. Ubuntu CVE-2024-50341
5. Ubuntu CVE-2024-51996
6. GitHub Advisory GHSA-mrqx-rp3w-jpjp / CVE-2024-50345
7. BitSight footprint for CVE-2024-50345
8. CISA Known Exploited Vulnerabilities Catalog