PT-2018-3149 · Symfony · Symfony

Federico Stange · Published 2018-05-25 · Updated 2022-05-14 · CVE-2018-11386

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions 2.7.x through 2.7.47 Symfony versions 2.8.x through 2.8.40 Symfony versions 3.3.x through 3.3.16 Symfony versions 3.4.x through 3.4.10 Symfony versions 4.0.x through 4.0.10

Description The issue is related to the HttpFoundation component in Symfony, specifically the PDOSessionHandler class, which allows storing sessions on a PDO connection. Under certain configurations and with a well-crafted payload, it is possible to cause a denial of service on a Symfony application without significant resources. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For Symfony versions 2.7.x through 2.7.47, update to version 2.7.48 or later. For Symfony versions 2.8.x through 2.8.40, update to version 2.8.41 or later. For Symfony versions 3.3.x through 3.3.16, update to version 3.3.17 or later. For Symfony versions 3.4.x through 3.4.10, update to version 3.4.11 or later. For Symfony versions 4.0.x through 4.0.10, update to version 4.0.11 or later.

Exploit

Fix

DoS

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2019-04244

CVE-2018-11386

DSA-4262-1

GHSA-R2RQ-3H56-FQM4

Affected Products

Symfony

References · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2018-11386 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11386 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04244 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH · Vendor Advisory
• https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-11386 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-11386 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV · Vendor Advisory
• https://debian.org/security/2018/dsa-4262 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4262-1 · Vendor Advisory