Fluid Attacks Database

Description

Symfony DoS An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	symfony/symfony	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.3.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
packagist	symfony/http-foundation	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.3.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
debian 13	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 11	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 12	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 14	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1

Aliases

1. CVE-2018-113862. NVD-2018-113863. OSV-2018-113864. OSV-DEBIAN-2018-113865. GCVE-2018-113866. SECURITY-TRACKER-CVE-2018-11386

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml2. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml3. https://lists.fedoraproject.org/archives/list/[email protected]/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV4. https://lists.fedoraproject.org/archives/list/[email protected]/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW5. https://lists.fedoraproject.org/archives/list/[email protected]/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH6. https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler7. https://symfony.com/cve-2018-113868. https://www.debian.org/security/2018/dsa-4262