GHSA-q8hg-pf8v-cxrvhigh8.1
Symfony Http-Kernel has non-constant time comparison in UriSigner
Impact
When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
symfony/http-kernel Packagist
| Affected range | Recorded fix |
|---|---|
| From 2.2.0 before 2.8.52Ecosystem versions | 2.8.52 |
| From 3.0.0 before 3.4.35Ecosystem versions | 3.4.35 |
| From 4.0.0 before 4.2.12Ecosystem versions | 4.2.12 |
| From 4.3.0 before 4.3.8Ecosystem versions | 4.3.8 |
Version evidence: OSV · GHSA-q8hg-pf8v-cxrv
View original version evidence (368 explicit versions)
symfony/symfony Packagist
| Affected range | Recorded fix |
|---|---|
| From 2.2.0 before 2.8.52Ecosystem versions | 2.8.52 |
| From 3.0.0 before 3.4.35Ecosystem versions | 3.4.35 |
| From 4.0.0 before 4.2.12Ecosystem versions | 4.2.12 |
| From 4.3.0 before 4.3.8Ecosystem versions | 4.3.8 |
Version evidence: OSV · GHSA-q8hg-pf8v-cxrv
View original version evidence (371 explicit versions)
Original source description
When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2019-18887
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2019-18887.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18887.yaml
- Release notes github.com/symfony/symfony/releases/tag/v4.3.8
- Source reference lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
- Source reference lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
- Source reference lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA
- Source reference lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ
- Security advisory symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
- Source reference symfony.com/blog/symfony-4-3-8-released
- Security advisory symfony.com/cve-2019-18887