~ / search / GHSA-g4g7-q726-v5hg

GHSA-g4g7-q726-v5hg

Symfony CSRF Token Fixation

Source: GitHub Advisory Database (reviewed) High CVE-2018-11406

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/symfony >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/symfony >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/symfony >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/symfony >= 4.0.0, < 4.0.11 4.0.11
Packagist symfony/security-bundle >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/security-bundle >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/security-bundle >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/security-bundle >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/security-bundle >= 4.0.0, < 4.0.11 4.0.11
Packagist symfony/security-http >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/security-http >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/security-http >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/security-http >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/security-http >= 4.0.0, < 4.0.11 4.0.11
Packagist symfony/security >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/security >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/security >= 3.0.0, < 3.3.17 3.3.17
Packagist symfony/security >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/security >= 4.0.0, < 4.0.11 4.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

References

External links from the advisory. They lead to third-party sites.