~ / search / GHSA-r2rq-3h56-fqm4

GHSA-r2rq-3h56-fqm4

Symfony DoS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-11386

Packages

EcosystemPackageAffectedFixed in
Packagist symfony/symfony >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/symfony >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/symfony >= 3.3.0, < 3.3.17 3.3.17
Packagist symfony/symfony >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/symfony >= 4.0.0, < 4.0.11 4.0.11
Packagist symfony/http-foundation >= 2.7.0, < 2.7.48 2.7.48
Packagist symfony/http-foundation >= 2.8.0, < 2.8.41 2.8.41
Packagist symfony/http-foundation >= 3.3.0, < 3.3.17 3.3.17
Packagist symfony/http-foundation >= 3.4.0, < 3.4.11 3.4.11
Packagist symfony/http-foundation >= 4.0.0, < 4.0.11 4.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

References

External links from the advisory. They lead to third-party sites.