GHSA-9mpf-g3fc-9rgv
FriendsOfSymfony FOSUserBundle denial of service via login form
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | friendsofsymfony/user-bundle | >= 1.2.0, < 1.2.5 | 1.2.5 |
| Packagist | friendsofsymfony/user-bundle | >= 1.3.0, < 1.3.3 | 1.3.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.
References
External links from the advisory. They lead to third-party sites.