~ / search / GHSA-g97c-jfx6-xvxh

GHSA-g97c-jfx6-xvxh

Symfony Vulnerable to Timing Attack

Source: GitHub Advisory Database (reviewed) High CVE-2015-8125

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.3.0, < 2.3.35 2.3.35
Packagist symfony/symfony >= 2.7.0, < 2.7.7 2.7.7
Packagist symfony/form >= 2.3.0, < 2.3.35 2.3.35
Packagist symfony/form >= 2.4.0, < 2.6.12 2.6.12
Packagist symfony/form >= 2.7.0, < 2.7.7 2.7.7
Packagist symfony/security-http >= 2.4.0, < 2.6.12 2.6.12
Packagist symfony/security-http >= 2.7.0, < 2.7.7 2.7.7
Packagist symfony/security >= 2.3.0, < 2.3.35 2.3.35
Packagist symfony/security >= 2.4.0, < 2.6.12 2.6.12
Packagist symfony/security >= 2.7.0, < 2.7.7 2.7.7
Packagist symfony/symfony >= 2.4.0, < 2.6.12 2.6.12

Details

As written in the advisory (Markdown source, shown as plain text).

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) `Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices` or (2) `Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener` class in the Symfony Security Component, or (3) legacy CSRF implementation from the `Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider` class in the Symfony Form component.

References

External links from the advisory. They lead to third-party sites.