CVE-2013-5958: Symfony Denial of Service Via Long Password Hashing
Summary
CVE-2013-5958: Symfony Denial of Service Via Long Password Hashing. Affects symfony/symfony across 4 version ranges.
>= 2.0.0, < 2.0.25
>= 2.1.0, < 2.1.13
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework that provides a set of reusable components and tools for building web applications. It is widely used in the PHP ecosystem and offers various features for handling security, routing, templating, and more. However, versions 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 of the Symfony Security component are vulnerable to a denial of service (DoS) attack due to inefficient password hashing.
Vulnerability Detail
The vulnerability in Symfony arises from the Security component's handling of long passwords during the password hashing process. When a long password is provided, the component performs an expensive hash computation, such as PBKDF2, which consumes excessive CPU resources. This can be exploited by remote attackers to cause a DoS condition, leading to high CPU consumption and potential service unavailability. The vulnerability is similar to CVE-2013-5750.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.252.0.25composer require symfony/symfony:2.0.25 -
>= 2.1.0, < 2.1.132.1.13composer require symfony/symfony:2.1.13 -
>= 2.2.0, < 2.2.92.2.9composer require symfony/symfony:2.2.9 -
>= 2.3.0, < 2.3.62.3.6composer require symfony/symfony:2.3.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, it is advisable to enforce password length limits and implement rate limiting mechanisms to mitigate the impact of potential DoS attacks.
Conclusion
The Symfony Security component in versions 2.0.x, 2.1.x, 2.2.x, and 2.3.x is vulnerable to a DoS attack due to inefficient password hashing. Upgrading to the latest patched version of Symfony is crucial to mitigate this vulnerability. Enforcing password length limits and implementing rate limiting mechanisms can also help reduce the impact of potential DoS attacks. For further assistance and support in vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for symfony/symfony →
FAQ
Symfony is a PHP framework that provides reusable components and tools for building web applications.
Versions 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 of the Symfony Security component are affected.
The vulnerability can be exploited by remote attackers to cause a denial of service (DoS) condition, leading to high CPU consumption and potential service unavailability.
While no specific workaround is provided, enforcing password length limits and implementing rate limiting mechanisms can help mitigate the impact of potential DoS attacks.
To fix this vulnerability, it is recommended to upgrade to a patched version of Symfony. Refer to the official Symfony documentation for detailed instructions on upgrading to the latest stable release.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
