CVE-2016-1902 (High) detected in symfony/security-core-v2.6.1

[mend-bolt-for-github]

CVE-2016-1902 - High Severity Vulnerability

Vulnerable Library - symfony/security-core-v2.6.1

Security provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. It is inspired by the Java Spring framework.

Dependency Hierarchy:

• symfony/form-v2.5.7 (Root Library)
  • symfony/security-csrf-v2.6.1
    • ❌ symfony/security-core-v2.6.1 (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

Publish Date: 2016-06-01

URL: CVE-2016-1902

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-1902

Release Date: 2016-06-01

Fix Resolution: 2.3.37,2.6.13,2.7.9

---

Step up your Open Source Security Game with Mend here