Symfony Denial of Service Via Long Password Hashing
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-5958US | medium5.0 | — | ||
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU con… | ||||
02
references
External citations — patches, advisories, analysis.
- http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-releasedWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/polyfill/CVE-2013-5958.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2013-5958.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-5958.yamlWEB
- https://github.com/symfony/polyfill/pull/155WEB
- https://github.com/symfony/symfonyPACKAGE
- https://github.com/symfony/symfony/issues/11522WEB
- https://nvd.nist.gov/vuln/detail/CVE-2013-5958ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan