PT-2016-4915 · Sensiolabs · Symfony

Fabpot · Published 2016-05-29 · Updated 2022-05-17 · CVE-2016-1902

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.3.37 Symfony versions 2.6.x prior to 2.6.13 Symfony versions 2.7.x prior to 2.7.9

Description The issue concerns the generation of random numbers by the nextBytes function in the SecureRandom class. When used with PHP 5.x and without the paragonie/random compat library, the function does not work correctly if the openssl random pseudo bytes function fails. This makes it easier for attackers to bypass cryptographic protection mechanisms.

Recommendations For Symfony versions prior to 2.3.37, update to version 2.3.37 or later. For Symfony versions 2.6.x prior to 2.6.13, update to version 2.6.13 or later. For Symfony versions 2.7.x prior to 2.7.9, update to version 2.7.9 or later.

Exploit

Fix

Weakness Enumeration

CWE-310

CWE-332

Related Identifiers

CVE-2016-1902

DSA-3588-1

GHSA-JJX5-FQ5G-8XPC

Affected Products

Symfony

References · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml · Exploit
• https://github.com/symfony/symfony/pull/17359 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-1902 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1902 · Security Note
• https://osv.dev/vulnerability/DSA-3588-1 · Vendor Advisory
• http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-1902 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-1902 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-1902 · Vendor Advisory
• http://debian.org/security/2016/dsa-3588 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/symfony · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jjx5-fq5g-8xpc · Vendor Advisory