CVE-2019-18887: Non-constant time comparison in UriSigner
Summary
CVE-2019-18887: Symfony Http-Kernel has non-constant time comparison in UriSigner. Affects symfony/http-kernel across 4 version ranges.
>= 2.2.0, < 2.8.52
>= 3.0.0, < 3.4.35
>= 4.0.0, < 4.2.12
>= 4.3.0, < 4.3.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2019-18887 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is symfony/http-kernel, which is a component of the Symfony framework. Symfony/http-kernel provides the core functionality for handling HTTP requests and responses in Symfony applications. It is responsible for routing, handling controllers, and managing the HTTP kernel. This vulnerability affects versions 2.2.0 to 2.8.52, 3.0.0 to 3.4.35, 4.0.0 to 4.2.12, and 4.3.0 to 4.3.8 of symfony/http-kernel.
Vulnerability Detail
The vulnerability arises from a non-constant time string comparison function used in the URISigner. This can potentially be exploited through a remote timing attack. An attacker could leverage the timing differences in the string comparison to deduce information about the signature of a URI, such as an ESI fragment URL. This could lead to unauthorized access or other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.8.522.8.52composer require symfony/http-kernel:2.8.52 -
>= 3.0.0, < 3.4.353.4.35composer require symfony/http-kernel:3.4.35 -
>= 4.0.0, < 4.2.124.2.12composer require symfony/http-kernel:4.2.12 -
>= 4.3.0, < 4.3.84.3.8composer require symfony/http-kernel:4.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended course of action is to apply the fix by updating the symfony/http-kernel package to the fixed versions.
Conclusion
In conclusion, the CVE-2019-18887 vulnerability in the symfony/http-kernel package exposes a potential remote timing attack vulnerability. It is crucial to update the package to the fixed versions to mitigate the risk of unauthorized access and other security breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/http-kernel →
FAQ
This vulnerability can potentially allow an attacker to deduce information about the signature of a URI, leading to unauthorized access or other security breaches.
Versions 2.2.0 to 2.8.52, 3.0.0 to 3.4.35, 4.0.0 to 4.2.12, and 4.3.0 to 4.3.8 of symfony/http-kernel are affected.
To update the symfony/http-kernel package, you can modify the composer.json file to specify the desired version and then run the composer update command.
There are no known exploits for this vulnerability at the moment.
Yes, you can find more information about this vulnerability in the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-kernel.
