Affected versions¶ Symfony >=2.8.0, <3.4.48 || >= 4.0.0, <4.4.23 || >= 5.0.0, <5.2.8 versions of the Symfony Security, Security Guard, Security Core, and Security HTTP components are affected by this security issue. The issue has been fixed in Symfony 3.4.48, 4.4.23, 5.2.8, and 5.3.0 beta4. All other affected minor versions of Symfony won’t be patched as they are not maintained anymore. Description¶ The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. Credits¶ I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
Sponsor the Symfony project.Connectez-vous pour ajouter un commentaire
Autres messages de ce groupe
This week, development activity mostly focused on dealing with the deprecation of sleep/wakeup methods in PHP 8.5 and their replacement by serialize/unserialize methods. In addition, we published more
It’s been only in July that we published symfony/ai and kicked off our AI initiative, but the repository has been busy since day one. Over 500 stars, more than 200 pull requests & issues, trending
🎤 Take the stage at SymfonyCon Amsterdam 2025, on your own terms!
The Unconference track is back and more dynamic than ever!
This unique, participant-driven format invites attendees to shape
This week, Symfony completed the migration to PHPUnit 12 in the 7.4 branch, which required many changes during the past weeks, such as replacing annotations with attributes. In addition, we updated th
🧑💻HACKDAY IS COMING!
Get ready to code, collaborate, and contribute, Symfony Hackday is back!
Join us in Amsterdam on Saturday, November 29th, for a hands-on hackathon designed to bring the
This week, Symfony released the maintenance versions 6.4.24, 7.2.9, and 7.3.2. Meanwhile, we began deprecating the XML configuration format in some components, enhanced the YAML configuration format t
Symfony 6.4.24 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in you
