Timing Attack Vulnerability in Symfony Package
Summary
CVE-2019-18887: An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Affects symfony across 6 version ranges.
< 4.3.8+dfsg-1
>= 33c98765dc6fec4907b7431d10e3c0945f061108, <= 8b123e7469953fa8e4112a02692dde2b6fdb0a7f
>= 34e089af7d363bd2ded8ad15f06b2b97348b97e5, <= a3eddd912d93a8c77ffee2b31448e13864257f4e
< 87fb08703e62882a7a6fdb17672070e0ee12dd65
>= 13594beb3faaeea891aaae9eeea8ffde16a99faf, <= a2f67dfe0ecfb713734847f4ada0f4231e28ae71
>= a8d5dd00894f8b5e3edb897f4504c51ddc442370, <= 7e0b49a8d10e31c0cd0431bbc99b20b6c5be4fb7
Fixed in 4.3.8+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a robust PHP framework widely used for building web applications. It provides reusable components and a structured architecture, making it a popular choice among developers. However, certain versions of Symfony have been found to be vulnerable to timing attacks, particularly affecting the UriSigner component, which is responsible for signing URIs to ensure their integrity and authenticity.
Vulnerability Detail
The vulnerability identified as CVE-2019-18887 affects Symfony versions 2.8.0 to 2.8.50, 3.4.0 to 3.4.34, 4.2.0 to 4.2.11, and 4.3.0 to 4.3.7. It arises from the UriSigner being susceptible to timing attacks, which can allow an attacker to infer information about the signed URIs based on the time it takes to process requests. This can lead to unauthorized access or manipulation of sensitive data, posing significant security risks to applications relying on this framework.
How To Fix
Minimum fixed version
4.3.8+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade symfonyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing additional security measures such as rate limiting on requests to the UriSigner or using alternative signing methods that are not vulnerable to timing attacks. However, these are temporary solutions and upgrading is strongly recommended.
Conclusion
The CVE-2019-18887 vulnerability in Symfony poses serious security risks due to its susceptibility to timing attacks. It is crucial for developers using affected versions to upgrade to version 4.3.8 or later to mitigate these risks. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for symfony →
FAQ
CVE-2019-18887 is a vulnerability in the Symfony framework that allows for timing attacks on the UriSigner component, potentially leading to unauthorized access.
The affected versions include Symfony 2.8.0 to 2.8.50, 3.4.0 to 3.4.34, 4.2.0 to 4.2.11, and 4.3.0 to 4.3.7.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2019-18887 is 8.1, indicating a high severity level.
If upgrading is not possible, consider implementing temporary security measures such as rate limiting or alternative signing methods until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for symfony.
