Laravel Sensitive Data Exposure
The advisory, in context
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 5.5.10
Fixed in 5.5.10
281 explicitly affected versions
5.0.30, 5.2.41, v4.0.0, v4.0.0-BETA2, v4.0.0-BETA3, v4.0.0-BETA4, v4.0.1, v4.0.10, v4.0.11, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.1, v4.1.10, v4.1.11, v4.1.12, v4.1.13, v4.1.14, v4.1.15, v4.1.16, v4.1.17, v4.1.18, v4.1.19, v4.1.2, v4.1.20, v4.1.21, v4.1.22, v4.1.23, v4.1.24, v4.1.25, v4.1.26, v4.1.27, v4.1.28, v4.1.29, v4.1.3, v4.1.30, v4.1.31, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9, v4.2.0, v4.2.0-BETA1, v4.2.1, v4.2.10, v4.2.11, v4.2.12, v4.2.13, v4.2.14, v4.2.15, v4.2.16, v4.2.17, v4.2.18, v4.2.19, v4.2.2, v4.2.20, v4.2.21, v4.2.22, v4.2.3, v4.2.4, v4.2.5, v4.2.6, v4.2.7, v4.2.8, v4.2.9, v5.0.0, v5.0.1, v5.0.10, v5.0.11, v5.0.12, v5.0.13, v5.0.14, v5.0.15, v5.0.16, v5.0.17, v5.0.18, v5.0.19, v5.0.2, v5.0.20, v5.0.21, v5.0.22, v5.0.23, v5.0.24, v5.0.25, v5.0.26, v5.0.27, v5.0.28, v5.0.29, v5.0.3, v5.0.31, v5.0.32, v5.0.33, v5.0.34, v5.0.35, v5.0.4, v5.0.5, v5.0.6, v5.0.7, v5.0.8, v5.0.9, v5.1.0, v5.1.1, v5.1.10, v5.1.11, v5.1.12, v5.1.13, v5.1.14, v5.1.15, v5.1.16, v5.1.17, v5.1.18, v5.1.19, v5.1.2, v5.1.20, v5.1.21, v5.1.22, v5.1.23, v5.1.24, v5.1.25, v5.1.26, v5.1.27, v5.1.28, v5.1.29, v5.1.3, v5.1.30, v5.1.31, v5.1.32, v5.1.33, v5.1.34, v5.1.35, v5.1.36, v5.1.37, v5.1.38, v5.1.39, v5.1.4, v5.1.40, v5.1.41, v5.1.42, v5.1.43, v5.1.44, v5.1.45, v5.1.46, v5.1.5, v5.1.6, v5.1.7, v5.1.8, v5.1.9, v5.2.0, v5.2.0-beta1, v5.2.1, v5.2.10, v5.2.11, v5.2.12, v5.2.13, v5.2.14, v5.2.15, v5.2.16, v5.2.17, v5.2.18, v5.2.19, v5.2.2, v5.2.20, v5.2.21, v5.2.22, v5.2.23, v5.2.24, v5.2.25, v5.2.26, v5.2.27, v5.2.28, v5.2.29, v5.2.3, v5.2.30, v5.2.31, v5.2.32, v5.2.33, v5.2.34, v5.2.35, v5.2.36, v5.2.37, v5.2.38, v5.2.39, v5.2.4, v5.2.40, v5.2.42, v5.2.43, v5.2.44, v5.2.45, v5.2.5, v5.2.6, v5.2.7, v5.2.8, v5.2.9, v5.3.0, v5.3.0-RC1, v5.3.1, v5.3.10, v5.3.11, v5.3.12, v5.3.13, v5.3.14, v5.3.15, v5.3.16, v5.3.17, v5.3.18, v5.3.19, v5.3.2, v5.3.20, v5.3.21, v5.3.22, v5.3.23, v5.3.24, v5.3.25, v5.3.26, v5.3.27, v5.3.28, v5.3.29, v5.3.3, v5.3.30, v5.3.31, v5.3.4, v5.3.5, v5.3.6, v5.3.7, v5.3.8, v5.3.9, v5.4.0, v5.4.1, v5.4.10, v5.4.11, v5.4.12, v5.4.13, v5.4.14, v5.4.15, v5.4.16, v5.4.17, v5.4.18, v5.4.19, v5.4.2, v5.4.20, v5.4.21, v5.4.22, v5.4.23, v5.4.24, v5.4.25, v5.4.26, v5.4.27, v5.4.28, v5.4.29, v5.4.3, v5.4.30, v5.4.31, v5.4.32, v5.4.33, v5.4.34, v5.4.35, v5.4.36, v5.4.4, v5.4.5, v5.4.6, v5.4.7, v5.4.8, v5.4.9, v5.5.0, v5.5.1, v5.5.2, v5.5.3, v5.5.4, v5.5.5, v5.5.6, v5.5.7, v5.5.8, v5.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.5.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.30",
"5.2.41",
"v4.0.0",
"v4.0.0-BETA2",
"v4.0.0-BETA3",
"v4.0.0-BETA4",
"v4.0.1",
"v4.0.10",
"v4.0.11",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.12",
"v4.1.13",
"v4.1.14",
"v4.1.15",
"v4.1.16",
"v4.1.17",
"v4.1.18",
"v4.1.19",
"v4.1.2",
"v4.1.20",
"v4.1.21",
"v4.1.22",
"v4.1.23",
"v4.1.24",
"v4.1.25",
"v4.1.26",
"v4.1.27",
"v4.1.28",
"v4.1.29",
"v4.1.3",
"v4.1.30",
"v4.1.31",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9",
"v4.2.0",
"v4.2.0-BETA1",
"v4.2.1",
"v4.2.10",
"v4.2.11",
"v4.2.12",
"v4.2.13",
"v4.2.14",
"v4.2.15",
"v4.2.16",
"v4.2.17",
"v4.2.18",
"v4.2.19",
"v4.2.2",
"v4.2.20",
"v4.2.21",
"v4.2.22",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6",
"v4.2.7",
"v4.2.8",
"v4.2.9",
"v5.0.0",
"v5.0.1",
"v5.0.10",
"v5.0.11",
"v5.0.12",
"v5.0.13",
"v5.0.14",
"v5.0.15",
"v5.0.16",
"v5.0.17",
"v5.0.18",
"v5.0.19",
"v5.0.2",
"v5.0.20",
"v5.0.21",
"v5.0.22",
"v5.0.23",
"v5.0.24",
"v5.0.25",
"v5.0.26",
"v5.0.27",
"v5.0.28",
"v5.0.29",
"v5.0.3",
"v5.0.31",
"v5.0.32",
"v5.0.33",
"v5.0.34",
"v5.0.35",
"v5.0.4",
"v5.0.5",
"v5.0.6",
"v5.0.7",
"v5.0.8",
"v5.0.9",
"v5.1.0",
"v5.1.1",
"v5.1.10",
"v5.1.11",
"v5.1.12",
"v5.1.13",
"v5.1.14",
"v5.1.15",
"v5.1.16",
"v5.1.17",
"v5.1.18",
"v5.1.19",
"v5.1.2",
"v5.1.20",
"v5.1.21",
"v5.1.22",
"v5.1.23",
"v5.1.24",
"v5.1.25",
"v5.1.26",
"v5.1.27",
"v5.1.28",
"v5.1.29",
"v5.1.3",
"v5.1.30",
"v5.1.31",
"v5.1.32",
"v5.1.33",
"v5.1.34",
"v5.1.35",
"v5.1.36",
"v5.1.37",
"v5.1.38",
"v5.1.39",
"v5.1.4",
"v5.1.40",
"v5.1.41",
"v5.1.42",
"v5.1.43",
"v5.1.44",
"v5.1.45",
"v5.1.46",
"v5.1.5",
"v5.1.6",
"v5.1.7",
"v5.1.8",
"v5.1.9",
"v5.2.0",
"v5.2.0-beta1",
"v5.2.1",
"v5.2.10",
"v5.2.11",
"v5.2.12",
"v5.2.13",
"v5.2.14",
"v5.2.15",
"v5.2.16",
"v5.2.17",
"v5.2.18",
"v5.2.19",
"v5.2.2",
"v5.2.20",
"v5.2.21",
"v5.2.22",
"v5.2.23",
"v5.2.24",
"v5.2.25",
"v5.2.26",
"v5.2.27",
"v5.2.28",
"v5.2.29",
"v5.2.3",
"v5.2.30",
"v5.2.31",
"v5.2.32",
"v5.2.33",
"v5.2.34",
"v5.2.35",
"v5.2.36",
"v5.2.37",
"v5.2.38",
"v5.2.39",
"v5.2.4",
"v5.2.40",
"v5.2.42",
"v5.2.43",
"v5.2.44",
"v5.2.45",
"v5.2.5",
"v5.2.6",
"v5.2.7",
"v5.2.8",
"v5.2.9",
"v5.3.0",
"v5.3.0-RC1",
"v5.3.1",
"v5.3.10",
"v5.3.11",
"v5.3.12",
"v5.3.13",
"v5.3.14",
"v5.3.15",
"v5.3.16",
"v5.3.17",
"v5.3.18",
"v5.3.19",
"v5.3.2",
"v5.3.20",
"v5.3.21",
"v5.3.22",
"v5.3.23",
"v5.3.24",
"v5.3.25",
"v5.3.26",
"v5.3.27",
"v5.3.28",
"v5.3.29",
"v5.3.3",
"v5.3.30",
"v5.3.31",
"v5.3.4",
"v5.3.5",
"v5.3.6",
"v5.3.7",
"v5.3.8",
"v5.3.9",
"v5.4.0",
"v5.4.1",
"v5.4.10",
"v5.4.11",
"v5.4.12",
"v5.4.13",
"v5.4.14",
"v5.4.15",
"v5.4.16",
"v5.4.17",
"v5.4.18",
"v5.4.19",
"v5.4.2",
"v5.4.20",
"v5.4.21",
"v5.4.22",
"v5.4.23",
"v5.4.24",
"v5.4.25",
"v5.4.26",
"v5.4.27",
"v5.4.28",
"v5.4.29",
"v5.4.3",
"v5.4.30",
"v5.4.31",
"v5.4.32",
"v5.4.33",
"v5.4.34",
"v5.4.35",
"v5.4.36",
"v5.4.4",
"v5.4.5",
"v5.4.6",
"v5.4.7",
"v5.4.8",
"v5.4.9",
"v5.5.0",
"v5.5.1",
"v5.5.2",
"v5.5.3",
"v5.5.4",
"v5.5.5",
"v5.5.6",
"v5.5.7",
"v5.5.8",
"v5.5.9"
]
}Earlier releases before 5.5.10
Fixed in 5.5.10
108 explicitly affected versions
v1.0.0, v1.1.0, v4.0.0, v4.0.0-BETA2, v4.0.0-BETA3, v4.0.0-BETA4, v4.0.1, v4.0.10, v4.0.2, v4.0.3, v4.0.4, v4.0.5, v4.0.6, v4.0.7, v4.0.8, v4.0.9, v4.1.0, v4.1.1, v4.1.10, v4.1.11, v4.1.12, v4.1.13, v4.1.14, v4.1.15, v4.1.16, v4.1.17, v4.1.18, v4.1.19, v4.1.2, v4.1.20, v4.1.21, v4.1.22, v4.1.23, v4.1.24, v4.1.25, v4.1.26, v4.1.27, v4.1.28, v4.1.29, v4.1.3, v4.1.30, v4.1.4, v4.1.5, v4.1.6, v4.1.7, v4.1.8, v4.1.9, v4.2.0-BETA1, v4.2.1, v4.2.12, v4.2.16, v4.2.17, v4.2.2, v4.2.3, v4.2.4, v4.2.5, v4.2.6, v4.2.7, v4.2.8, v4.2.9, v5.0.0, v5.0.22, v5.0.25, v5.0.26, v5.0.28, v5.0.33, v5.0.4, v5.1.1, v5.1.13, v5.1.16, v5.1.2, v5.1.20, v5.1.22, v5.1.25, v5.1.28, v5.1.30, v5.1.31, v5.1.41, v5.1.6, v5.1.8, v5.2.0, v5.2.19, v5.2.21, v5.2.24, v5.2.25, v5.2.26, v5.2.27, v5.2.28, v5.2.31, v5.2.32, v5.2.37, v5.2.43, v5.2.45, v5.2.6, v5.2.7, v5.3.0, v5.3.16, v5.3.23, v5.3.4, v5.4.0, v5.4.13, v5.4.17, v5.4.19, v5.4.27, v5.4.36, v5.4.9, v5.5.0, v5.5.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.5.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.0",
"v1.1.0",
"v4.0.0",
"v4.0.0-BETA2",
"v4.0.0-BETA3",
"v4.0.0-BETA4",
"v4.0.1",
"v4.0.10",
"v4.0.2",
"v4.0.3",
"v4.0.4",
"v4.0.5",
"v4.0.6",
"v4.0.7",
"v4.0.8",
"v4.0.9",
"v4.1.0",
"v4.1.1",
"v4.1.10",
"v4.1.11",
"v4.1.12",
"v4.1.13",
"v4.1.14",
"v4.1.15",
"v4.1.16",
"v4.1.17",
"v4.1.18",
"v4.1.19",
"v4.1.2",
"v4.1.20",
"v4.1.21",
"v4.1.22",
"v4.1.23",
"v4.1.24",
"v4.1.25",
"v4.1.26",
"v4.1.27",
"v4.1.28",
"v4.1.29",
"v4.1.3",
"v4.1.30",
"v4.1.4",
"v4.1.5",
"v4.1.6",
"v4.1.7",
"v4.1.8",
"v4.1.9",
"v4.2.0-BETA1",
"v4.2.1",
"v4.2.12",
"v4.2.16",
"v4.2.17",
"v4.2.2",
"v4.2.3",
"v4.2.4",
"v4.2.5",
"v4.2.6",
"v4.2.7",
"v4.2.8",
"v4.2.9",
"v5.0.0",
"v5.0.22",
"v5.0.25",
"v5.0.26",
"v5.0.28",
"v5.0.33",
"v5.0.4",
"v5.1.1",
"v5.1.13",
"v5.1.16",
"v5.1.2",
"v5.1.20",
"v5.1.22",
"v5.1.25",
"v5.1.28",
"v5.1.30",
"v5.1.31",
"v5.1.41",
"v5.1.6",
"v5.1.8",
"v5.2.0",
"v5.2.19",
"v5.2.21",
"v5.2.24",
"v5.2.25",
"v5.2.26",
"v5.2.27",
"v5.2.28",
"v5.2.31",
"v5.2.32",
"v5.2.37",
"v5.2.43",
"v5.2.45",
"v5.2.6",
"v5.2.7",
"v5.3.0",
"v5.3.16",
"v5.3.23",
"v5.3.4",
"v5.4.0",
"v5.4.13",
"v5.4.17",
"v5.4.19",
"v5.4.27",
"v5.4.36",
"v5.4.9",
"v5.5.0",
"v5.5.2"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2017-14775
- https://github.com/laravel/framework/pull/21320
- https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-14775.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-14775.yaml
- https://github.com/laravel/framework/releases/tag/v5.5.10
- https://laravel-news.com/laravel-v5-5-11