CVE-2016-4423: Symphony Denial of Service Via Overlong Usernames
Summary
CVE-2016-4423: Symphony Denial of Service Via Overlong Usernames. Affects symfony/security-http across 4 version ranges.
>= 2.3.0, < 2.3.41
>= 2.4.0, < 2.7.13
>= 2.8.0, < 2.8.6
>= 3.0.0, < 3.0.6
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2016-4423 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symphony package is a PHP web application framework that provides a set of reusable components and tools for building web applications. It includes the Symfony Security component, which handles authentication and authorization. This vulnerability affects versions before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 of the Symphony Security component.
Vulnerability Detail
The vulnerability resides in the attemptAuthentication function in the UsernamePasswordFormAuthenticationListener.php file. This function does not enforce a limit on the length of a username stored in a session. As a result, an attacker can exploit this by repeatedly attempting authentication with long, non-existent usernames. This can lead to a denial of service (session storage consumption) as the server allocates resources to store these invalid usernames.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.412.3.41composer require symfony/security-http:2.3.41 -
>= 2.4.0, < 2.7.132.7.13composer require symfony/security-http:2.7.13 -
>= 2.8.0, < 2.8.62.8.6composer require symfony/security-http:2.8.6 -
>= 3.0.0, < 3.0.63.0.6composer require symfony/security-http:3.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Symphony package is vulnerable to a denial of service attack due to the lack of username length validation in the session storage. Upgrading to the latest version of the Symphony Security component is recommended to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/security-http →
FAQ
The vulnerability can be exploited by remote attackers to cause a denial of service by consuming excessive session storage.
No, this vulnerability does not affect the authentication process itself. It only impacts the session storage.
The recommended mitigation is to upgrade to the latest version of the Symphony Security component.
Yes, the CVSS score for this vulnerability is 7.5.
You can find more information about this vulnerability in the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-http.
