CVE-2018-11386: Medium severity symfony vulnerability

Q: What is the severity of CVE-2018-11386?

The severity of CVE-2018-11386 is medium, with a severity value of 5.9.

Q: How does CVE-2018-11386 affect Symfony?

CVE-2018-11386 affects Symfony versions 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11.

Q: What is the vulnerability in CVE-2018-11386?

The vulnerability in CVE-2018-11386 is a denial of service vulnerability when using PDOSessionHandler in Symfony.

Q: How can I fix CVE-2018-11386?

To fix CVE-2018-11386, update Symfony to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, or 4.0.11.

Q: Where can I find more information about CVE-2018-11386?

You can find more information about CVE-2018-11386 at the following links: [Symfony](https://symfony.com/cve-2018-11386), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-11386), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/)

Published May 25, 2018

Updated

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Other sources

CVE-2018-11386: Denial of service when using PDOSessionHandler

Affected Software

19 affected componentsFixes available

composer/symfony/symfony>=2.0.0, <2.1.0, >=2.1.0, <2.2.0, >=2.2.0, <2.3.0, >=2.3.0, <2.4.0, >=2.4.0, <2.5.0, >=2.5.0, <2.6.0, >=2.6.0, <2.7.0, >=2.7.0, <2.7.48, >=2.8.0, <2.8.41, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.3.17, >=3.4.0, <3.4.11, >=4.0.0, <4.0.11

composer/symfony/http-foundation>=2.0.0, <2.1.0, >=2.1.0, <2.2.0, >=2.2.0, <2.3.0, >=2.3.0, <2.4.0, >=2.4.0, <2.5.0, >=2.5.0, <2.6.0, >=2.6.0, <2.7.0, >=2.7.0, <2.7.48, >=2.8.0, <2.8.41, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.3.17, >=3.4.0, <3.4.11, >=4.0.0, <4.0.11

debian/symfony

3.4.22+dfsg-2+deb10u13.4.22+dfsg-2+deb10u24.4.19+dfsg-2+deb11u35.4.23+dfsg-15.4.29+dfsg-15.4.30+dfsg-1

composer/symfony/http-foundation>=4.0.0<4.0.11

4.0.11

composer/symfony/http-foundation>=3.4.0<3.4.11

3.4.11

composer/symfony/http-foundation>=3.3.0<3.3.17

3.3.17

composer/symfony/http-foundation>=2.8.0<2.8.41

2.8.41

composer/symfony/http-foundation>=2.7.0<2.7.48

2.7.48

composer/symfony/symfony>=4.0.0<4.0.11

4.0.11

composer/symfony/symfony>=3.4.0<3.4.11

3.4.11

composer/symfony/symfony>=3.3.0<3.3.17

3.3.17

composer/symfony/symfony>=2.8.0<2.8.41

2.8.41

composer/symfony/symfony>=2.7.0<2.7.48

2.7.48

SensioLabs Symfony>=2.7.0<2.7.48

SensioLabs Symfony>=2.8.0<2.8.41

SensioLabs Symfony>=3.3.0<3.3.17

SensioLabs Symfony>=3.4.0<3.4.11

SensioLabs Symfony>=4.0.0<4.0.11

Debian Debian Linux=9.0

Event History

May 25, 2018

Advisory Published

02:04 PM

Jun 13, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-11386?

The severity of CVE-2018-11386 is medium, with a severity value of 5.9.

How does CVE-2018-11386 affect Symfony?