PT-2016-5952 · Symfony · Symfony

Marek Alaksa · Published 2016-05-29 · Updated 2022-05-17 · CVE-2016-4423

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.3.41 Symfony versions 2.7.x prior to 2.7.13 Symfony versions 2.8.x prior to 2.8.6 Symfony versions 3.0.x prior to 3.0.6

Description The issue is related to the attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php, which does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.

Recommendations For Symfony versions prior to 2.3.41, update to version 2.3.41 or later. For Symfony versions 2.7.x prior to 2.7.13, update to version 2.7.13 or later. For Symfony versions 2.8.x prior to 2.8.6, update to version 2.8.6 or later. For Symfony versions 3.0.x prior to 3.0.6, update to version 3.0.6 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-4423

DSA-3588-1

GHSA-WHGV-8CG3-7HCM

Affected Products

Symfony

References · 17

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2016-4423.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-4423.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-4423.yaml · Exploit
• https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4423 · Security Note
• https://ubuntu.com/security/CVE-2016-4423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4423 · Security Note
• http://debian.org/security/2016/dsa-3588 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3588-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-whgv-8cg3-7hcm · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4423 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4423 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4423 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4423 · Vendor Advisory
• https://github.com/symfony/symfony · Note