Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-2g8z-51nu-17hs
|
Session Fixation
Session validation vulnerability.
|
ZF2015-01
|
|
VCID-mra6-33ez-xbda
|
Zend-Session session validation vulnerability
`Zend\Session` session validators do not work as expected if set prior to the start of a session.
For instance, the following test case fails (where $this->manager is an instance of `Zend\Session\SessionManager`):
```
$this
->manager
->getValidatorChain()
->attach('session.validate', array(new RemoteAddr(), 'isValid'));
$this->manager->start();
$this->assertSame(
array(
'Zend\Session\Validator\RemoteAddr' =3D> '',
),
$_SESSION['__ZF']['_VALID']
);
```
The implication is that subsequent calls to `Zend\Session\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.
An attacker is thus able to simply ignore session validators such as `RemoteAddr` or `HttpUserAgent`, since the "signature" that these validators check against is not being stored in the session.
|
GHSA-96c6-m98x-hxjx
|