{"id":"GHSA-9mpf-g3fc-9rgv","aliases":["CVE-2013-5750"],"title":"FriendsOfSymfony FOSUserBundle denial of service via login form","description":"The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.","severity":"medium","score":null,"published":"2022-05-17T05:00:37.000Z","modified":"2024-12-06T05:33:16.697Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"friendsofsymfony/user-bundle","ranges":[{"events":[{"introduced":"1.2.0"},{"fixed":"1.2.5"}],"type":"ECOSYSTEM"}],"versions":["1.2.0","v1.2.1","v1.2.2","v1.2.3","v1.2.4"],"fixed":["1.2.5"]},{"ecosystem":"Packagist","name":"friendsofsymfony/user-bundle","ranges":[{"events":[{"introduced":"1.3.0"},{"fixed":"1.3.3"}],"type":"ECOSYSTEM"}],"versions":["v1.3.0","v1.3.1","v1.3.2"],"fixed":["1.3.3"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2013-5750","https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/user-bundle/CVE-2013-5750.yaml","https://symfony.com/cve-2013-5750","http://symfony.com/blog/cve-2013-5750-security-issue-in-fosuserbundle-login-form"],"sources":[{"name":"OSV","id":"GHSA-9mpf-g3fc-9rgv","modified":"2024-12-06T05:33:16.697212Z","url":"https://osv.dev/vulnerability/GHSA-9mpf-g3fc-9rgv"}],"assessments":[]}