Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2019-18887

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.

VectorNETWORK

PublishedNov 21, 2019, 23:15

Published Bycve@mitre.org

Base Score

Score8.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

symfony/http-kernel(Packagist)2.2.02.8.52N/A

symfony/http-kernel(Packagist)3.0.03.4.35N/A

symfony/http-kernel(Packagist)4.0.04.2.12N/A

symfony/http-kernel(Packagist)4.3.04.3.8N/A

symfony/symfony(Packagist)2.2.02.8.52N/A

symfony/symfony(Packagist)3.0.03.4.35N/A

symfony/symfony(Packagist)4.0.04.2.12N/A

symfony/symfony(Packagist)4.3.04.3.8N/A

References

https://github.com/symfony/symfony/releases/tag/v4.3.8
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
https://symfony.com/blog/symfony-4-3-8-released

Weakness Type

CWE-203

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK