github.com
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2019-18887.yaml CVE-2019-18887
HIGH
Symfony Http-Kernel has non-constant time comparison in UriSigner
Record summary
CVE-2019-18887 has a selected CVSS score of 8.1 (high).
Description
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
Description source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
symfony/http-kernelBrowse Packagist / symfony/http-kernel | GitHub Advisory | 2.2.0 to < 2.8.52 · Fixed in 2.8.52 | affected |
| 3.0.0 to < 3.4.35 · Fixed in 3.4.35 | affected | ||
| 4.0.0 to < 4.2.12 · Fixed in 4.2.12 | affected | ||
| 4.3.0 to < 4.3.8 · Fixed in 4.3.8 | affected | ||
symfony/symfonyBrowse Packagist / symfony/symfony | GitHub Advisory | 2.2.0 to < 2.8.52 · Fixed in 2.8.52 | affected |
| 3.0.0 to < 3.4.35 · Fixed in 3.4.35 | affected | ||
| 4.0.0 to < 4.2.12 · Fixed in 4.2.12 | affected | ||
| 4.3.0 to < 4.3.8 · Fixed in 4.3.8 | affected |
References
Showing 12 of 13github.com
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18887.yaml github.comConfirmation
https://github.com/symfony/symfony/releases/tag/v4.3.8 FEDORA-2019-9c2ad3b018Vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX FEDORA-2019-8b0ba02338Vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA FEDORA-2019-5ae4fd9203Vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-18887 symfony.comConfirmation
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner symfony.comConfirmation
https://symfony.com/blog/symfony-4-3-8-released