PT-2016-4915 · Sensiolabs · Symfony

Fabpot · Publicado 2016-05-29 · Atualizado 2022-05-17 · CVE-2016-1902

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.3.37 Symfony versions 2.6.x prior to 2.6.13 Symfony versions 2.7.x prior to 2.7.9

Description The issue concerns the generation of random numbers by the nextBytes function in the SecureRandom class. When used with PHP 5.x and without the paragonie/random compat library, the function does not work correctly if the openssl random pseudo bytes function fails. This makes it easier for attackers to bypass cryptographic protection mechanisms.

Recommendations For Symfony versions prior to 2.3.37, update to version 2.3.37 or later. For Symfony versions 2.6.x prior to 2.6.13, update to version 2.6.13 or later. For Symfony versions 2.7.x prior to 2.7.9, update to version 2.7.9 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

CWE-332

Identificadores relacionados

CVE-2016-1902

DSA-3588-1

GHSA-JJX5-FQ5G-8XPC

Produtos afetados

Symfony

Referências · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml · Exploit
• https://github.com/symfony/symfony/pull/17359 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1902 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-3588-1 · Aviso do Fabricante
• http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails · Aviso do Fabricante
• https://packages.debian.org/src:symfony · Nota
• https://cve.org/CVERecord?id=CVE-2016-1902 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-1902 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-1902 · Aviso do Fabricante
• http://debian.org/security/2016/dsa-3588 · Aviso do Fabricante
• https://landaire.net/blog/cve-2016-1902-symfony-securerandom · Nota