HIGH7.5
GHSA-jjx5-fq5g-8xpc
Symfony Cryptographic Vulnerability
Quick fix
GHSA-jjx5-fq5g-8xpc — symfony/security-core: upgrade to the fixed version with the command below.
composer require symfony/security-core:^2.6.13Details
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/symfony/security-core
Introduced in:
2.4.0Fixed in: 2.6.13Fix
composer require symfony/security-core:^2.6.13Packagist/symfony/security-core
Introduced in:
2.7.0Fixed in: 2.7.9Fix
composer require symfony/security-core:^2.7.9Packagist/symfony/security
Introduced in:
2.3.0Fixed in: 2.3.37Fix
composer require symfony/security:^2.3.37Packagist/symfony/security
Introduced in:
2.4.0Fixed in: 2.6.13Fix
composer require symfony/security:^2.6.13Packagist/symfony/security
Introduced in:
2.7.0Fixed in: 2.7.9Fix
composer require symfony/security:^2.7.9Packagist/symfony/symfony
Introduced in:
2.3.0Fixed in: 2.3.37Fix
composer require symfony/symfony:^2.3.37Packagist/symfony/symfony
Introduced in:
2.4.0Fixed in: 2.6.13Fix
composer require symfony/symfony:^2.6.13Packagist/symfony/symfony
Introduced in:
2.7.0Fixed in: 2.7.9Fix
composer require symfony/symfony:^2.7.9References
- https://nvd.nist.gov/vuln/detail/CVE-2016-1902[ADVISORY]
- https://github.com/symfony/symfony/pull/17359[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml[WEB]
- https://symfony.com/cve-2016-1902[WEB]
- https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom[WEB]
- http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails[WEB]
- http://www.debian.org/security/2016/dsa-3588[WEB]