| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/http-kernel | ≥ 2.2.0, < 2.8.52≥ 3.0.0, < 3.4.35≥ 4.0.0, < 4.2.12≥ 4.3.0, < 4.3.8 | 2.8.523.4.354.2.124.3.8 |
| symfony/symfony | ≥ 2.2.0, < 2.8.52≥ 3.0.0, < 3.4.35≥ 4.0.0, < 4.2.12≥ 4.3.0, < 4.3.8 | 2.8.523.4.354.2.124.3.8 |
| symfony | ≥ 2.8.0, ≤ 2.8.50≥ 3.4.0, ≤ 3.4.34≥ 4.2.0, ≤ 4.2.11≥ 4.3.0, ≤ 4.3.7 |
When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free