Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-g97c-jfx6-xvxh
Advisory ID github_osv/GHSA-g97c-jfx6-xvxh
Aliases CVE-2015-8125
Summary Symfony Vulnerable to Timing Attack Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) `Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices` or (2) `Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener` class in the Symfony Security Component, or (3) legacy CSRF implementation from the `Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider` class in the Symfony Form component.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-208 Observable Timing Discrepancy
System Score Found at
generic_textual HIGH
Reference id Reference type URL
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml
https://github.com/symfony/symfony/pull/16630
https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service
https://web.archive.org/web/20200228050051/http://www.securityfocus.com/bid/77692
http://www.debian.org/security/2015/dsa-3402
http://www.securityfocus.com/bid/77692
CVE-2015-8125 https://nvd.nist.gov/vuln/detail/CVE-2015-8125
CVE-2015-8125 https://symfony.com/cve-2015-8125
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.