PT-2015-7733 · Symfony · Symfony

Sebastiaan Stok · Published 2015-11-24 · Updated 2022-05-17 · CVE-2015-8125

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symfony versions 2.3.x through 2.3.34 Symfony versions 2.6.x through 2.6.11 Symfony versions 2.7.x through 2.7.6

Description The issue could allow remote attackers to have an unspecified impact through a timing attack involving the classes (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener in the Symfony Security Component, or (3) legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.

Recommendations For Symfony 2.3.x, update to version 2.3.35 or later. For Symfony 2.6.x, update to version 2.6.12 or later. For Symfony 2.7.x, update to version 2.7.7 or later. As a temporary workaround, consider restricting access to the Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices and Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener classes, as well as the legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class, until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2015-8125

DSA-3402-1

GHSA-G97C-JFX6-XVXH

Affected Products

Symfony

References · 28

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-8125 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8125 · Security Note
• https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3402-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8125 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-8125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8125 · Vendor Advisory
• http://debian.org/security/2015/dsa-3402 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3402-1 · Vendor Advisory