PT-2015-7733 · Symfony · Symfony

Sebastiaan Stok · Publicado 2015-11-24 · Atualizado 2022-05-17 · CVE-2015-8125

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symfony versions 2.3.x through 2.3.34 Symfony versions 2.6.x through 2.6.11 Symfony versions 2.7.x through 2.7.6

Description The issue could allow remote attackers to have an unspecified impact through a timing attack involving the classes (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Recommendations For Symfony 2.3.x, update to version 2.3.35 or later. For Symfony 2.6.x, update to version 2.6.12 or later. For Symfony 2.7.x, update to version 2.7.7 or later. As a temporary workaround, consider restricting access to the Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices and Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener classes, as well as the legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class, until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-208

Identificadores relacionados

CVE-2015-8125

DSA-3402-1

GHSA-G97C-JFX6-XVXH

Produtos afetados

Symfony

Referências · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml · Exploit
• https://github.com/symfony/symfony/pull/16630 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2015-8125 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125 · Nota de Segurança
• https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3402-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-8125 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html · Aviso do Fabricante
• https://symfony.com/cve-2015-8125 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-8125 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-8125 · Aviso do Fabricante