Insecure Random Number Generation in Symfony: CVE-2016-1902
Summary
CVE-2016-1902: The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat... Affects symfony across 45 version ranges.
< 0da4693f29ece3fd71a27785af71afc23d5d86fa
< 1da0b42145752d02371c054b456bcd6ccf9573d5
< 1fdf23fe28876844b887b0e1935c9adda43ee645
< 2.7.9+dfsg-1
< 4b23f57f066f55f49faf77988fd92a30a90014bd
< 4ec4a8580c90ee6d66f173d78064f7c1a8408dfa
< 7ae1934082d9ac299303b146e4a999274a723e94
< 8a896ba1384394707312d9e440ab4accc6878d4b
< 9d1072d0706af30b5649fee3deb65bc536a08b2a
< 23b647f1e4eeb24a457d3c47f5f5046377d5a3bf
< 48c9e835a877adfb023b8b6d033d9dd14f342b4b
< 66b2e9662c44d478b69e48278aa54079a006eb42
< 79ab33409de4c9ea4c59e6c0ac87282ceb8b7ec5
< 85a24514fdc5245cafab010b8fe90dc10ade94fa
< 118fdb3bba3e8d0b71c680852b4b91986b6c50d5
< 0449d0e1178bc8e934520b20432d1705c3b25e7e
< 0584bd00f498ea463159ae5dc8e8aedc730d4ef9
< 645bb3248db50d653d18929eb0c92b131b4f35ad
< 932b6e7499c670f4db6d0b871477a4a3ca161e74
< 934b077ab565e40b97f27849fd870915888387ce
< 969d709ad428076bf1084e386dc26dd904d9fb84
< 5965d31e1b49470b47016d4e313f41a18d15dd10
< 9975b1eca3de4db792a2c3e4e16f676a4aadcd46
< 80833da9d04b004fa59fd23102e6dfad80c98106
< 619528a274647cffc1792063c3ea04c4fa8266a0
< 6606075d52eef52d6715d9e215528e24b1cef6ab
< 780497980a3c8905e0c784c2c51bccb54e546709
< a9af4708b4bb650c4897e9b8dfbfbdb2ea5f0486
< ad264021e44a5aaa132f16aef69f92e56795683e
< b06539573ccf64dd3a62852685f052553d02c5ba
< b72ca4bdc77a7fd00478fd6822f11c116e20a0b2
< b4457f16a753d2e9651e1bb9b8faeaf48f9e9fe7
< bfd8e114413a5ef35df4f77cf79e10e3d924a921
< c6ab380a577e7bfb8db6e6f3105f470f97c83235
< c34ef418015793a4653f2670afb69dd167ebf578
< cc69dbd24b4b2e6de60b2414ef95da2794f459a2
< d35f486fd8db598e27bd9027cfc80b32a3061d45
< d805dfd67950848ec0338b4acd75777b340977b7
< da5940fe25525c6010b51da594ab71baaece0ed5
< de2f3d51160791ef254010953dbde178fee9845f
< e246af5f3bdf64fa5a85936ee78e3574e094cf5f
< e167796e3720a271cd6ac2f7f25ba49ca16b0fa2
< efa64f772bf61cebf7ac66e472ef856623c3df9f
< f2cc31fdcb2f80a0d9355800daf6906c6abb0f82
< f6ed7007ff16c8d2a01adcaf624ea81f0faa6476
Fixed in 2.7.9+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a robust PHP framework widely used for building web applications. It provides reusable PHP components and a structured architecture that simplifies the development process. However, certain versions of Symfony are vulnerable to a flaw in the SecureRandom class, which can lead to predictable random number generation, compromising cryptographic security.
Vulnerability Detail
The vulnerability, identified as CVE-2016-1902, arises from the nextBytes function in the SecureRandom class of Symfony versions prior to 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9. When used with PHP 5.x without the paragonie/random_compat library, the function fails to generate secure random numbers. This flaw can be exploited by attackers to defeat cryptographic protections, potentially leading to unauthorized access or data breaches.
How To Fix
Minimum fixed version
2.7.9+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade symfonyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing the paragonie/random_compat library in your project. This library provides a secure random number generator that can be used as a temporary measure until a full upgrade is performed. You can include it in your project using Composer with the following command: composer require paragonie/random_compat.
Conclusion
CVE-2016-1902 presents a significant risk to applications using vulnerable versions of Symfony due to insecure random number generation. It is crucial to upgrade to the latest version or implement workarounds to mitigate potential security threats.
See every vulnerability recorded for symfony →
FAQ
CVE-2016-1902 is a vulnerability in Symfony that affects the SecureRandom class, leading to insecure random number generation.
The affected versions include Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9.
The vulnerability can allow attackers to predict random numbers, potentially compromising cryptographic protections and leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-1902 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for symfony.
