~ / search / GHSA-35c5-28pg-2qg4

GHSA-35c5-28pg-2qg4

Symfony Authentication Bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-11407

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/security-core >= 2.8.0, < 2.8.37 2.8.37
Packagist symfony/security-core >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/security-core >= 3.4.0, < 3.4.7 3.4.7
Packagist symfony/security-core >= 4.0.0, < 4.0.7 4.0.7
Packagist symfony/security >= 2.8.0, < 2.8.37 2.8.37
Packagist symfony/security >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/security >= 3.4.0, < 3.4.7 3.4.7
Packagist symfony/security >= 4.0.0, < 4.0.7 4.0.7
Packagist symfony/symfony >= 2.8.0, < 2.8.37 2.8.37
Packagist symfony/symfony >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/symfony >= 3.4.0, < 3.4.7 3.4.7
Packagist symfony/symfony >= 4.0.0, < 4.0.7 4.0.7

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the LDAP component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. **NOTE:** this issue exists because of an incomplete fix for CVE-2016-2403.

References

External links from the advisory. They lead to third-party sites.