CVE-2013-5750

The CVE concerns the FriendsOfSymfony FOSUserBundle login form (Symfony) prior to 1.3.3. The vulnerability is a denial of service caused by an expensive hash computation triggered by a very long password (PBKDF2), leading to high CPU usage. The connected records confirm the issue and its scope bu...

CVE-2013-5750: Security issue in FOSUserBundle login form

Django recently released a new version of their framework to address a possible DOS attack when an attacker uses a very long password on a login form. One of the best practices for passwords is to store a hash of the password instead of the raw value. In Symfony, the encoders are responsible for...

Request::getHost() poisoning

More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...

Request::getHost() poisoning

More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...

Validation metadata serialization and loss of information

More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...

Validation metadata serialization and loss of information

More info at https://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released...

Security releases: Symfony 2.0.24, 2.1.12, 2.2.5, and 2.3.3 released

Log in to add a reaction to this post add a reaction ❤️ 👍 🚀 Symfony 2.0.24, 2.1.12, 2.2.5, and 2.3.3 have just been released and they contain security fixes for the Validator component CVE-2013-4751 and the HttpFoundation component CVE-2013-4752. Even if Symfony 2.0 and 2.1 are out of maintenance,...

symfony

This plugin greps every page for traces of the Symfony framework and the lack of CSRF protection. Plugin type Grep Options Name | Type | Default Value | Description | Help ---|---|---|---|--- override | boolean | False | Skip symfony detection and search for the csrf misprotection. | No detailed...

Security release: Symfony 2.0.22 and 2.1.7 released

Symfony 2.0.22 and Symfony 2.1.7 have just been released and they both contain security fixes for the YAML component CVE-2013-1348 and CVE-2013-1397. CVE-2013-1348: Ability to enable/disable PHP parsing in Yaml::parse Affected versions All 2.0.X versions of the YAML component are affected by this...

Ability to enable/disable object support in YAML parsing and dumping

More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...

Ability to enable/disable object support in YAML parsing and dumping

More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...

Ability to enable/disable PHP parsing in Yaml::parse()

More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...

Ability to enable/disable PHP parsing in Yaml::parse()

More info at https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released...

CVE-2012-6431

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string...

CVE-2012-6432

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /internal substring...

Spoofing

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string...

CVE-2012-6432

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /internal substring...

CVE-2012-6431

Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string...

CVE-2012-6431

CVE-2012-6431 affects Symfony 2.0.x (from 2.0.0 through 2.0.19), where the Routing and Security components mishandle URL-encoded data, allowing a doubly encoded string to bypass URI restrictions. The root cause is a double-decoding flow: UrlMatcher decodes the path again while RequestMatcher does...

CVE-2012-6432

Summary (concrete details from provided sources): CVE-2012-6432 affects Symfony 2.0.x up to 2.0.19, Symfony 2.1.x up to 2.1.4, and 2.2-dev, when the internal routes configuration is enabled. A vulnerability in the internal routing mechanism, via URIs starting with /_internal, allows an attacker t...