GHSA-q8hg-pf8v-cxrvHighCVSS 8.1

Symfony Http-Kernel has non-constant time comparison in UriSigner

Published
March 26, 2022
Last Modified
February 1, 2024

🔗 CVE IDs covered (1)

CVE-2019-18887 →

📋 Description

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.

🎯 Affected products8

  • composer/symfony/http-kernel:>= 2.2.0, < 2.8.52
  • composer/symfony/http-kernel:>= 3.0.0, < 3.4.35
  • composer/symfony/http-kernel:>= 4.0.0, < 4.2.12
  • composer/symfony/http-kernel:>= 4.3.0, < 4.3.8
  • composer/symfony/symfony:>= 2.2.0, < 2.8.52
  • composer/symfony/symfony:>= 3.0.0, < 3.4.35
  • composer/symfony/symfony:>= 4.0.0, < 4.2.12
  • composer/symfony/symfony:>= 4.3.0, < 4.3.8

🔗 References (14)