Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/friendsofsymfony/user-bundle@1.2.5
purl pkg:composer/friendsofsymfony/user-bundle@1.2.5
Next non-vulnerable version 1.3.5
Latest non-vulnerable version 1.3.5
Risk
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-cp9j-3948-mud8
Aliases:
GMS-2014-38
Insufficient Entropy Entropy is lost in the `TokenGenerator`.
1.3.0
Affected by 2 other vulnerabilities.
VCID-yyyq-za39-r3hh
Aliases:
GHSA-pjx8-984p-7p3x
FOSUserBundle Entropy is lost in the TokenGenerator Because of the usage of base_convert which looses precision for large inputs, the entropy of tokens generated by FOSUserBundle for the email confirmation and password resetting is lost. This makes these tokens much less random than they are expected to be, and so not cryptographically safe.
1.3.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ky5a-sata-5yf6 Uncontrolled Resource Consumption The login form in the FriendsOfSymfony FOSUserBundle bundle for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation. CVE-2013-5750
GHSA-9mpf-g3fc-9rgv

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T04:54:52.088487+00:00 GitLab Importer Affected by VCID-yyyq-za39-r3hh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/friendsofsymfony/user-bundle/GHSA-pjx8-984p-7p3x.yml 38.6.0
2026-06-04T20:04:28.031423+00:00 GitLab Importer Affected by VCID-cp9j-3948-mud8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/friendsofsymfony/user-bundle/GMS-2014-38.yml 38.6.0
2026-06-04T17:55:42.244953+00:00 GithubOSV Importer Fixing VCID-ky5a-sata-5yf6 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9mpf-g3fc-9rgv/GHSA-9mpf-g3fc-9rgv.json 38.6.0
2026-06-02T04:36:11.125064+00:00 GitLab Importer Fixing VCID-ky5a-sata-5yf6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/friendsofsymfony/user-bundle/CVE-2013-5750.yml 38.6.0