PT-2019-5090 · Symfony · Symfony

Stof · Published 2019-11-18 · Updated 2022-03-26 · CVE-2019-18887

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions 2.8.0 through 2.8.50 Symfony versions 3.4.0 through 3.4.34 Symfony versions 4.2.0 through 4.2.11 Symfony versions 4.3.0 through 4.3.7

Description The issue is related to the UriSigner in Symfony, which is subject to timing attacks due to the lack of a constant time string comparison function when checking the signature of an URI. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is related to concurrent execution and the use of a shared resource with improper synchronization.

Recommendations For Symfony versions 2.8.0 through 2.8.50, update to a version that includes a fix for the UriSigner timing attack issue. For Symfony versions 3.4.0 through 3.4.34, update to a version that includes a fix for the UriSigner timing attack issue. For Symfony versions 4.2.0 through 4.2.11, update to a version that includes a fix for the UriSigner timing attack issue. For Symfony versions 4.3.0 through 4.3.7, update to a version that includes a fix for the UriSigner timing attack issue.

Exploit

Fix

Race Condition

Side Channel Attack

Weakness Enumeration

CWE-362

CWE-203

Related Identifiers

BDU:2020-01756

CVE-2019-18887

DLA-1999-1

DSA-4573-1

GHSA-Q8HG-PF8V-CXRV

Affected Products

Symfony

References · 27

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2019-18887.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18887.yaml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18887 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ · Vendor Advisory
• https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18887 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01756 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18887 · Security Note
• https://osv.dev/vulnerability/DSA-4573-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8hg-pf8v-cxrv · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18887 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA · Vendor Advisory