CVE-2013-5958: Medium severity symfony vulnerability
Possible DOS attack with long user-submitted passwords
Other sources
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to CVE-2013-5750.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5958?
CVE-2013-5958 has a severity rating of medium, indicating that it allows for potential denial of service attacks under specific conditions.
How do I fix CVE-2013-5958?
To fix CVE-2013-5958, update Symfony to versions 2.0.25, 2.1.13, 2.2.9, or 2.3.6 or later.
Which versions of Symfony are affected by CVE-2013-5958?
CVE-2013-5958 affects Symfony versions 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6.
What type of vulnerability is CVE-2013-5958?
CVE-2013-5958 is a denial of service vulnerability caused by handling overly long user-submitted passwords.
Is there a workaround for CVE-2013-5958 if I can't update immediately?
A temporary workaround for CVE-2013-5958 involves implementing input validation to restrict password lengths to a reasonable limit.