Lucene search
HistoryDec 27, 2014 - 6:59 p.m.
CVE-2013-5958
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
6.6
Confidence
Low
EPSS
0.002
Percentile
64.5%
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.
Affected configurations
Node
sensiolabssymfonyMatch2.0.0
ORsensiolabssymfonyMatch2.0.1
ORsensiolabssymfonyMatch2.0.2
ORsensiolabssymfonyMatch2.0.3
ORsensiolabssymfonyMatch2.0.4
ORsensiolabssymfonyMatch2.0.5
ORsensiolabssymfonyMatch2.0.6
ORsensiolabssymfonyMatch2.0.7
ORsensiolabssymfonyMatch2.0.8
ORsensiolabssymfonyMatch2.0.9
ORsensiolabssymfonyMatch2.0.10
ORsensiolabssymfonyMatch2.0.11
ORsensiolabssymfonyMatch2.0.12
ORsensiolabssymfonyMatch2.0.13
ORsensiolabssymfonyMatch2.0.14
ORsensiolabssymfonyMatch2.0.15
ORsensiolabssymfonyMatch2.0.16
ORsensiolabssymfonyMatch2.0.17
ORsensiolabssymfonyMatch2.0.18
ORsensiolabssymfonyMatch2.0.19
ORsensiolabssymfonyMatch2.0.20
ORsensiolabssymfonyMatch2.0.21
ORsensiolabssymfonyMatch2.0.22
ORsensiolabssymfonyMatch2.0.23
ORsensiolabssymfonyMatch2.0.24
ORsensiolabssymfonyMatch2.1.0
ORsensiolabssymfonyMatch2.1.1
ORsensiolabssymfonyMatch2.1.2
ORsensiolabssymfonyMatch2.1.3
ORsensiolabssymfonyMatch2.1.4
ORsensiolabssymfonyMatch2.1.5
ORsensiolabssymfonyMatch2.1.6
ORsensiolabssymfonyMatch2.1.7
ORsensiolabssymfonyMatch2.1.8
ORsensiolabssymfonyMatch2.1.9
ORsensiolabssymfonyMatch2.1.10
ORsensiolabssymfonyMatch2.1.11
ORsensiolabssymfonyMatch2.1.12
ORsensiolabssymfonyMatch2.2dev
ORsensiolabssymfonyMatch2.2.0
ORsensiolabssymfonyMatch2.2.1
ORsensiolabssymfonyMatch2.2.2
ORsensiolabssymfonyMatch2.2.3
ORsensiolabssymfonyMatch2.2.4
ORsensiolabssymfonyMatch2.2.5
ORsensiolabssymfonyMatch2.2.6
ORsensiolabssymfonyMatch2.2.8
ORsensiolabssymfonyMatch2.3.0
ORsensiolabssymfonyMatch2.3.1
ORsensiolabssymfonyMatch2.3.2
ORsensiolabssymfonyMatch2.3.3
ORsensiolabssymfonyMatch2.3.4
ORsensiolabssymfonyMatch2.3.5
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sensiolabs | symfony | 2.0.0 | cpe:2.3:a:sensiolabs:symfony:2.0.0:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.1 | cpe:2.3:a:sensiolabs:symfony:2.0.1:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.2 | cpe:2.3:a:sensiolabs:symfony:2.0.2:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.3 | cpe:2.3:a:sensiolabs:symfony:2.0.3:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.4 | cpe:2.3:a:sensiolabs:symfony:2.0.4:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.5 | cpe:2.3:a:sensiolabs:symfony:2.0.5:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.6 | cpe:2.3:a:sensiolabs:symfony:2.0.6:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.7 | cpe:2.3:a:sensiolabs:symfony:2.0.7:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.8 | cpe:2.3:a:sensiolabs:symfony:2.0.8:*:*:*:*:*:*:* |
| sensiolabs | symfony | 2.0.9 | cpe:2.3:a:sensiolabs:symfony:2.0.9:*:*:*:*:*:*:* |
Related
symfony
symfony
Security releases (CVE-2013-5958): Symfony 2.0.25, 2.1.13, 2.2.9, and 2.3.6 released
2013-10-10 00:00:00
CVE-2013-5750: Security issue in FOSUserBundle login form
2013-09-23 00:00:00
prion
prion
Design/Logic Flaw
2014-12-27 18:59:00
Design/Logic Flaw
2013-09-25 10:31:00
debiancve
debiancve
CVE-2013-5958
2014-12-27 18:59:01
cvelist
cvelist
CVE-2013-5958
2014-12-27 18:00:00
CVE-2013-5750
2013-09-25 10:00:00
cve
cve
CVE-2013-5958
2014-12-27 18:59:01
CVE-2013-5750
2013-09-25 10:31:29
osv
osv
Symfony Denial of Service Via Long Password Hashing
2022-05-17 04:19:02
FriendsOfSymfony FOSUserBundle denial of service via login form
2022-05-17 05:00:37
github
github
Symfony Denial of Service Via Long Password Hashing
2022-05-17 04:19:02
FriendsOfSymfony FOSUserBundle denial of service via login form
2022-05-17 05:00:37
friendsofphp
friendsofphp
DOS attack in FOSUserBundle login form
2012-09-23 10:11:26
Possible DOS attack with long user-submitted passwords
2013-10-10 08:30:51
veracode
veracode
Denial Of Service (DoS)
2017-07-07 10:52:56
nessus
nessus
openvas
openvas
Fedora Update for php-symfony2-HttpFoundation FEDORA-2013-22422
2013-12-17 00:00:00
Fedora Update for php-symfony2-Locale FEDORA-2013-22422
2013-12-17 00:00:00
Fedora Update for php-symfony2-Routing FEDORA-2013-22422
2013-12-17 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: php-symfony2-HttpFoundation-2.2.10-1.fc18
2013-12-09 02:00:07
[SECURITY] Fedora 18 Update: php-symfony2-Locale-2.2.10-1.fc18
2013-12-09 02:00:09
[SECURITY] Fedora 18 Update: php-symfony2-Form-2.2.10-1.fc18
2013-12-09 02:00:08
nvd
nvd
CVE-2013-5750
2013-09-25 10:31:29
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
6.6
Confidence
Low
EPSS
0.002
Percentile
64.5%
Related for NVD:CVE-2013-5958