8.1
CVE-2019-18887
- EPSS 1.34%
- Veröffentlicht 21.11.2019 23:15:13
- Zuletzt bearbeitet 21.11.2024 04:33:46
- Erkennungen
LoginAn issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sensiolabs ≫ Symfony Version >= 2.8.0 <= 2.8.50
Sensiolabs ≫ Symfony Version >= 3.4.0 <= 3.4.34
Sensiolabs ≫ Symfony Version >= 4.2.0 <= 4.2.11
Sensiolabs ≫ Symfony Version >= 4.3.0 <= 4.3.7
Fedoraproject ≫ Fedora Version 30
Fedoraproject ≫ Fedora Version 31
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.34% | 0.676 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| NIST | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-203 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
https://github.com/symfony/symfony/releases/tag/v4.3.8
https://symfony.com/blog/symfony-4-3-8-released
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/
https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner