CVE-2018-11386
First published: Fri May 25 2018(Updated: )
An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/symfony/symfony | >=2.0.0<2.1.0>=2.1.0<2.2.0>=2.2.0<2.3.0>=2.3.0<2.4.0>=2.4.0<2.5.0>=2.5.0<2.6.0>=2.6.0<2.7.0>=2.7.0<2.7.48>=2.8.0<2.8.41>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.3.17>=3.4.0<3.4.11>=4.0.0<4.0.11 | |
| composer/symfony/http-foundation | >=2.0.0<2.1.0>=2.1.0<2.2.0>=2.2.0<2.3.0>=2.3.0<2.4.0>=2.4.0<2.5.0>=2.5.0<2.6.0>=2.6.0<2.7.0>=2.7.0<2.7.48>=2.8.0<2.8.41>=3.0.0<3.1.0>=3.1.0<3.2.0>=3.2.0<3.3.0>=3.3.0<3.3.17>=3.4.0<3.4.11>=4.0.0<4.0.11 | |
| composer/symfony/symfony | >=4.0.0<4.0.11 | 4.0.11 |
| composer/symfony/symfony | >=3.4.0<3.4.11 | 3.4.11 |
| composer/symfony/symfony | >=3.3.0<3.3.17 | 3.3.17 |
| composer/symfony/symfony | >=2.8.0<2.8.41 | 2.8.41 |
| composer/symfony/symfony | >=2.7.0<2.7.48 | 2.7.48 |
| SensioLabs Symfony | >=2.7.0<2.7.48 | |
| SensioLabs Symfony | >=2.8.0<2.8.41 | |
| SensioLabs Symfony | >=3.3.0<3.3.17 | |
| SensioLabs Symfony | >=3.4.0<3.4.11 | |
| SensioLabs Symfony | >=4.0.0<4.0.11 | |
| Debian Debian Linux | =9.0 | |
| debian/symfony | 3.4.22+dfsg-2+deb10u1 3.4.22+dfsg-2+deb10u2 4.4.19+dfsg-2+deb11u3 5.4.23+dfsg-1 5.4.29+dfsg-1 5.4.30+dfsg-1 | |
| composer/symfony/http-foundation | >=4.0.0<4.0.11 | 4.0.11 |
| composer/symfony/http-foundation | >=3.4.0<3.4.11 | 3.4.11 |
| composer/symfony/http-foundation | >=3.3.0<3.3.17 | 3.3.17 |
| composer/symfony/http-foundation | >=2.8.0<2.8.41 | 2.8.41 |
| composer/symfony/http-foundation | >=2.7.0<2.7.48 | 2.7.48 |
| >=2.7.0<2.7.48 | ||
| >=2.8.0<2.8.41 | ||
| >=3.3.0<3.3.17 | ||
| >=3.4.0<3.4.11 | ||
| >=4.0.0<4.0.11 | ||
| =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://symfony.com/cve-2018-11386
- https://nvd.nist.gov/vuln/detail/CVE-2018-11386
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
- https://symfony.com/blog/cve-2018-11386-denial-of-service-when-using-pdosessionhandler
- https://www.debian.org/security/2018/dsa-4262
- https://github.com/advisories/GHSA-r2rq-3h56-fqm4 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2018-11386
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-11386.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11386.yaml
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
Frequently Asked Questions
What is the severity of CVE-2018-11386?
The severity of CVE-2018-11386 is medium, with a severity value of 5.9.
How does CVE-2018-11386 affect Symfony?
CVE-2018-11386 affects Symfony versions 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11.
What is the vulnerability in CVE-2018-11386?
The vulnerability in CVE-2018-11386 is a denial of service vulnerability when using PDOSessionHandler in Symfony.
How can I fix CVE-2018-11386?
To fix CVE-2018-11386, update Symfony to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, or 4.0.11.
Where can I find more information about CVE-2018-11386?
You can find more information about CVE-2018-11386 at the following links: [Symfony](https://symfony.com/cve-2018-11386), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-11386), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/)
- collector/friends-of-php
- collector/nvd-index
- collector/security-tracker-debian
- agent/author
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r2rq-3h56-fqm4
- alias/CVE-2018-11386
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- agent/description
- agent/references
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/tags
- agent/trending
- package-manager/composer
- vendor/sensiolabs
- canonical/sensiolabs symfony
- version/sensiolabs symfony/2.7.0
- version/sensiolabs symfony/2.8.0
- version/sensiolabs symfony/3.3.0
- version/sensiolabs symfony/3.4.0
- version/sensiolabs symfony/4.0.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- package-manager/debian