| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/security | ≥ 2.3.0, < 2.3.41≥ 2.4.0, < 2.7.13≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.3.412.7.132.8.63.0.6 |
| symfony/security-http | ≥ 2.3.0, < 2.3.41≥ 2.4.0, < 2.7.13≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.3.412.7.132.8.63.0.6 |
| symfony/symfony | ≥ 2.3.0, < 2.3.41≥ 2.4.0, < 2.7.13≥ 2.8.0, < 2.8.6≥ 3.0.0, < 3.0.6 | 2.3.412.7.132.8.63.0.6 |
| symfony | = 2.7.0= 2.7.1= 2.7.10= 2.7.11= 2.7.12= 2.7.2= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.7.9= 2.8.0= 2.8.1= 2.8.2= 2.8.3= 2.8.4= 2.8.5= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5≤ 2.3.40 |
The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free