PT-2024-40401 · Unknown · Fosuserbundle

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions FOSUserBundle versions 2.0.x and earlier

Description The usage of base convert in FOSUserBundle results in a loss of precision for large inputs, reducing the entropy of tokens generated for email confirmation and password resetting. This makes the tokens less random and not cryptographically safe.

Recommendations For FOSUserBundle versions 2.0.x and earlier, update the token generation logic to use base64 encoding, which has been backported from the 2.0.x branch. Additionally, update any route placeholder expected to match a token generated by FOSUserBundle to allow dashes by changing the w+ requirement to [w-]+ in regexes.

Weakness Enumeration

CWE-331

Related Identifiers

GHSA-PJX8-984P-7P3X

Affected Products

Fosuserbundle

References · 5

• https://osv.dev/vulnerability/GHSA-pjx8-984p-7p3x · Vendor Advisory
• https://github.com/FriendsOfSymfony/FOSUserBundle · Note
• https://github.com/FriendsOfSymfony/FOSUserBundle/commit/b3ebfea52065e9727508f5f8e6c9f7459a1b06d8 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/2014-09-04-1.yaml · Note
• https://symfony.com/blog/fosuserbundle-entropy-of-generated-tokens-is-lost · Note