~ / search / GHSA-q8hg-pf8v-cxrv

GHSA-q8hg-pf8v-cxrv

Symfony Http-Kernel has non-constant time comparison in UriSigner

Source: GitHub Advisory Database (reviewed) High CVE-2019-18887

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/http-kernel >= 2.2.0, < 2.8.52 2.8.52
Packagist symfony/http-kernel >= 3.0.0, < 3.4.35 3.4.35
Packagist symfony/http-kernel >= 4.0.0, < 4.2.12 4.2.12
Packagist symfony/http-kernel >= 4.3.0, < 4.3.8 4.3.8
Packagist symfony/symfony >= 2.2.0, < 2.8.52 2.8.52
Packagist symfony/symfony >= 3.0.0, < 3.4.35 3.4.35
Packagist symfony/symfony >= 4.0.0, < 4.2.12 4.2.12
Packagist symfony/symfony >= 4.3.0, < 4.3.8 4.3.8

Details

As written in the advisory (Markdown source, shown as plain text).

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.

References

External links from the advisory. They lead to third-party sites.