Incorrect Comparison in Symfony - CVE-2019-18887
Published: November 19, 2019 / Updated: November 19, 2019
Vulnerability identifier: #VU22851
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-18887
CWE-ID: CWE-697
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists within the HttpKernel component in Symfony when checking the signature of an URI (an ESI fragment URL for
instance) due to the URISigner does not use a constant time string comparison
function. A remote attacker can perform a timing attack and gain access to sensitive functionality.
Affected software
Symfony
symfony (Debian package)
php-symfony
php-symfony3
Fedora
symfony (Debian package)
php-symfony
php-symfony3
Fedora
How to mitigate CVE-2019-18887
Install updates from vendor's website.
Symfony - addressed in versions 2.8.52, 3.4.35, 4.2.12, 4.3.8
symfony (Debian package) - addressed in versions 2.8.7+dfsg-1.3+deb9u3, 3.4.22+dfsg-2+deb10u1
php-symfony - addressed in versions 2.8.52-1.fc30, 2.8.52-1.fc31
php-symfony3 - update to 3.4.35-2.fc31
symfony (Debian package) - addressed in versions 2.8.7+dfsg-1.3+deb9u3, 3.4.22+dfsg-2+deb10u1
php-symfony - addressed in versions 2.8.52-1.fc30, 2.8.52-1.fc31
php-symfony3 - update to 3.4.35-2.fc31