CVE-2013-5750: FriendsOfSymfony FOSUserBundle Denial of Service
Summary
CVE-2013-5750: FriendsOfSymfony FOSUserBundle denial of service via login form. Affects friendsofsymfony/user-bundle across 2 version ranges.
>= 1.2.0, < 1.2.5
>= 1.3.0, < 1.3.3
Fixed in 1.2.5 or 1.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
FriendsOfSymfony FOSUserBundle is a bundle for the Symfony framework that provides user management functionality. It allows developers to easily add user registration, login, and other user-related features to their Symfony applications. This vulnerability affects versions before 1.3.3 of the bundle.
Vulnerability Detail
The vulnerability in the FriendsOfSymfony FOSUserBundle allows remote attackers to cause a denial of service (CPU consumption) by exploiting the login form. By submitting a long password, the attacker triggers an expensive hash computation, specifically a PBKDF2 computation. This computation consumes significant CPU resources and can lead to a denial of service condition. The vulnerability is assigned CVE-2013-5750.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.2.0, < 1.2.51.2.5composer require friendsofsymfony/user-bundle:1.2.5 -
>= 1.3.0, < 1.3.31.3.3composer require friendsofsymfony/user-bundle:1.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version of the FriendsOfSymfony FOSUserBundle as soon as possible.
Conclusion
The FriendsOfSymfony FOSUserBundle before version 1.3.3 is vulnerable to a denial of service attack. To mitigate this vulnerability, it is recommended to update to version 1.3.3 or later of the bundle. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for friendsofsymfony/user-bundle →
FAQ
The vulnerability allows remote attackers to cause a denial of service by consuming significant CPU resources. This can lead to degraded performance or even a complete system outage.
No, authentication is not required. The vulnerability can be exploited by anyone who can access the login form of an affected application.
There are no known public exploits for this vulnerability at the time of this advisory.
Yes, this vulnerability can be exploited remotely. Attackers can trigger the denial of service condition by submitting a specially crafted long password to the login form.
No, only versions before 1.3.3 of the FriendsOfSymfony FOSUserBundle are affected. Version 1.3.3 and later include a fix for the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for friendsofsymfony/user-bundle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
