GHSA-r2rq-3h56-fqm4
Symfony DoS
At a glance
- Published
- Updated
- CVE
- CVE-2018-11386
- CVSS_V3
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
Affected packages
| Package | Versions |
|---|---|
| Packagist · symfony/symfony | introduced 2.7.0, fixed 2.7.48 |
| Packagist · symfony/symfony | introduced 2.8.0, fixed 2.8.41 |
| Packagist · symfony/symfony | introduced 3.3.0, fixed 3.3.17 |
| Packagist · symfony/symfony | introduced 3.4.0, fixed 3.4.11 |
| Packagist · symfony/symfony | introduced 4.0.0, fixed 4.0.11 |
| Packagist · symfony/http-foundation | introduced 2.7.0, fixed 2.7.48 |
| Packagist · symfony/http-foundation | introduced 2.8.0, fixed 2.8.41 |
| Packagist · symfony/http-foundation | introduced 3.3.0, fixed 3.3.17 |
| Packagist · symfony/http-foundation | introduced 3.4.0, fixed 3.4.11 |
| Packagist · symfony/http-foundation | introduced 4.0.0, fixed 4.0.11 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-11386 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml WEB
- https://github.com/symfony/symfony PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH WEB
- https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler WEB
- https://symfony.com/cve-2018-11386 WEB
- https://www.debian.org/security/2018/dsa-4262 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |