7.5high
CVE-2016-1902
Symfony Cryptographic Vulnerability
Also known as GHSA-jjx5-fq5g-8xpc
Published 10 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
0
none known
Summary
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Exploit prediction (EPSS)
1.91% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | symfony/security-core | >=2.4.0, <2.6.13 >=2.7.0, <2.7.9 | 2.6.13 2.7.9 |
| packagist | symfony/security | >=2.3.0, <2.3.37 >=2.4.0, <2.6.13 >=2.7.0, <2.7.9 | 2.3.37 2.6.13 2.7.9 |
| packagist | symfony/symfony | >=2.3.0, <2.3.37 >=2.4.0, <2.6.13 >=2.7.0, <2.7.9 | 2.3.37 2.6.13 2.7.9 |
Classification
References
- symfony.com /blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails · x_refsource_CONFIRM, x_transferred
- github.com /symfony/symfony/pull/17359 · x_refsource_CONFIRM, x_transferred
- landaire.net /blog/cve-2016-1902-symfony-securerandom/ · x_refsource_MISC, x_transferred
- debian.org /security/2016/dsa-3588 · vendor-advisory, x_refsource_DEBIAN, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-1902 · advisory
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-1902.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-1902.yaml · web
- github.com /FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-1902.yaml · web
- symfony.com /cve-2016-1902 · web
- landaire.net /blog/cve-2016-1902-symfony-securerandom · web
Sources
- CVE List: CVE-2016-1902
- GitHub Advisory: GHSA-jjx5-fq5g-8xpc
- NVD: CVE-2016-1902
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.