About CVE-2020-15094

[kanade0404]

There is an RCE vulnerability in symfony/http-kernel, do you update the version in laravel?
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15094
For example, in 6.x, the http-kernel version is ^4.3.4, which seems to be the version affected.

[mbabker]

4.3.4 is the minimum supported Symfony version, the constraint basically means any 4.x version higher than 4.3.4 can be used.

Laravel 6 will run just fine on the latest Symfony 4.4 release.

[kanade0404]

Thanks for telling me, @mbabker 🙏