Timing Attack

symfony/security is vulnerable to timing attacks. The attacks are possible because BasePasswordEncoder hashes are not compared using constant time...