Affected versions¶ Symfony >=2.8.0, <3.4.48 || >= 4.0.0, <4.4.23 || >= 5.0.0, <5.2.8 versions of the Symfony Security, Security Guard, Security Core, and Security HTTP components are affected by this security issue. The issue has been fixed in Symfony 3.4.48, 4.4.23, 5.2.8, and 5.3.0 beta4. All other affected minor versions of Symfony won’t be patched as they are not maintained anymore. Description¶ The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. Credits¶ I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Sponsor the Symfony project.Connectez-vous pour ajouter un commentaire
Autres messages de ce groupe
This blog post highlights the key accomplishments of the Symfony project in 2024. We are grateful for your continuous support, which enabled the Symfony project to achieve a remarkable year.
Releases
This week, Symfony 6.4.17, 7.1.10 and 7.2.2 maintenance versions were released. In addition, we published more information about the upcoming SymfonyOnline January 2025 conference.
Symfony developmen
Get ready for the exciting SymfonyOnline January 2025, kicking off shortly on January 16-17! There’s still time to register and join the international online Symfony conference—along with pre-
Symfony 6.4.17 has just been released. Here is the list of the most important changes since 6.4.16:
bug #59304 [PropertyInfo] Remove @internal from PropertyReadInfo and PropertyWriteInfo (Dario G
Symfony 7.1.10 has just been released. Here is the list of the most important changes since 7.1.9:
bug #59304 [PropertyInfo] Remove @internal from PropertyReadInfo and PropertyWriteInfo (Dario Gu
Symfony 7.2.2 has just been released. Here is the list of the most important changes since 7.2.1:
bug #59304 [PropertyInfo] Remove @internal from PropertyReadInfo and PropertyWriteInfo (Dario Gua
This week, we launched the new Twig playground, a tool that lets you test and experiment with Twig features in a safe, sandboxed environment. While Symfony development activity was lighter than usual
