CVE-2020-5275: Incorrect Authorization

In symfony/security-http, when a Firewall checks access control rule, it iterates overs each rule’s attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in a unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute.