CVE-2017-14775: Infoleak
Published Sep 21, 2017
·Updated
Laravel before 5.5.10 mishandles the rememberme token verification process because DatabaseUserProvider does not have constant-time token comparison.
Other sources
Timing attack vector for remember me token
Affected Software
5 affected componentsFixes available
composer/laravel/framework>=4.1.26, <=4.1.31, >=4.2.0, <=4.2.22, >=5.0.0, <=5.0.35, >=5.1.0, <=5.1.46, >=5.2.0, <=5.2.45, >=5.3.0, <=5.3.31, >=5.4.0, <=5.4.36, >=5.5.0, <5.5.10
composer/illuminate/auth>=4.1.26, <=4.1.31, >=4.2.0, <=4.2.22, >=5.0.0, <=5.0.35, >=5.1.0, <=5.1.46, >=5.2.0, <=5.2.45, >=5.3.0, <=5.3.31, >=5.4.0, <=5.4.36, >=5.5.0, <5.5.10
composer/illuminate/auth<5.5.10
5.5.10
composer/laravel/framework<5.5.10
5.5.10
Laravel Laravel<=5.5.9
Event History
Sep 21, 2017
Advisory Published
01:38 AM
Sep 27, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14775?
CVE-2017-14775 has a medium severity rating due to its potential for timing attacks against the remember_me token.
2
How do I fix CVE-2017-14775?
To fix CVE-2017-14775, upgrade to Laravel version 5.5.10 or higher.
3
What versions of Laravel are affected by CVE-2017-14775?
CVE-2017-14775 affects Laravel versions prior to 5.5.10, including 4.x and 5.4.
4
What is the root cause of CVE-2017-14775?
CVE-2017-14775 is caused by the DatabaseUserProvider not using constant-time comparison for remember_me token verification.
5
Is it safe to use Laravel versions below 5.5.10 due to CVE-2017-14775?
Using Laravel versions below 5.5.10 poses a security risk due to the vulnerability in token handling.