CVE-2017-14775: Infoleak
First published: Thu Sep 21 2017(Updated: )
Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/laravel/framework | >=4.1.26<=4.1.31>=4.2.0<=4.2.22>=5.0.0<=5.0.35>=5.1.0<=5.1.46>=5.2.0<=5.2.45>=5.3.0<=5.3.31>=5.4.0<=5.4.36>=5.5.0<5.5.10 | |
| composer/illuminate/auth | >=4.1.26<=4.1.31>=4.2.0<=4.2.22>=5.0.0<=5.0.35>=5.1.0<=5.1.46>=5.2.0<=5.2.45>=5.3.0<=5.3.31>=5.4.0<=5.4.36>=5.5.0<5.5.10 | |
| composer/laravel/framework | <5.5.10 | 5.5.10 |
| Laravel Laravel | <=5.5.9 | |
| composer/illuminate/auth | <5.5.10 | 5.5.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/laravel/framework/pull/21320
- https://nvd.nist.gov/vuln/detail/CVE-2017-14775
- https://github.com/laravel/framework/releases/tag/v5.5.10
- https://laravel-news.com/laravel-v5-5-11
- https://github.com/advisories/GHSA-c2v7-j5gq-wcq4 (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/illuminate/auth/CVE-2017-14775.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/laravel/framework/CVE-2017-14775.yaml
Frequently Asked Questions
What is the severity of CVE-2017-14775?
CVE-2017-14775 has a medium severity rating due to its potential for timing attacks against the remember_me token.
How do I fix CVE-2017-14775?
To fix CVE-2017-14775, upgrade to Laravel version 5.5.10 or higher.
What versions of Laravel are affected by CVE-2017-14775?
CVE-2017-14775 affects Laravel versions prior to 5.5.10, including 4.x and 5.4.
What is the root cause of CVE-2017-14775?
CVE-2017-14775 is caused by the DatabaseUserProvider not using constant-time comparison for remember_me token verification.
Is it safe to use Laravel versions below 5.5.10 due to CVE-2017-14775?
Using Laravel versions below 5.5.10 poses a security risk due to the vulnerability in token handling.
- collector/friends-of-php
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c2v7-j5gq-wcq4
- alias/CVE-2017-14775
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/composer
- vendor/laravel
- canonical/laravel laravel
- version/laravel laravel/5.5.9