Vulnerabilities > CVE-2018-11386 - Insufficient Session Expiration vulnerability in multiple products

CVSS 5.9 - MEDIUM

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

high complexity

sensiolabs

debian

CWE-613

nessus

NVD

Published: 2018-06-13

Updated: 2023-11-07

Summary

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.

Vulnerable Configurations

Part	Description	Count
Application	Sensiolabs Sensiolabs Symfony 2.7.0 Sensiolabs Symfony 2.7.1 Sensiolabs Symfony 2.7.2 Sensiolabs Symfony 2.7.3 Sensiolabs Symfony 2.7.4 Sensiolabs Symfony 2.7.5 Sensiolabs Symfony 2.7.6 Sensiolabs Symfony 2.7.7 Sensiolabs Symfony 2.7.8 Sensiolabs Symfony 2.7.9 Sensiolabs Symfony 2.7.10 Sensiolabs Symfony 2.7.11 Sensiolabs Symfony 2.7.12 Sensiolabs Symfony 2.7.13 Sensiolabs Symfony 2.7.14 Sensiolabs Symfony 2.7.15 Sensiolabs Symfony 2.7.16 Sensiolabs Symfony 2.7.17 Sensiolabs Symfony 2.7.18 Sensiolabs Symfony 2.7.19 Sensiolabs Symfony 2.7.20 Sensiolabs Symfony 2.7.21 Sensiolabs Symfony 2.7.22 Sensiolabs Symfony 2.7.23 Sensiolabs Symfony 2.7.24 Sensiolabs Symfony 2.7.25 Sensiolabs Symfony 2.7.26 Sensiolabs Symfony 2.7.27 Sensiolabs Symfony 2.7.28 Sensiolabs Symfony 2.7.29 Sensiolabs Symfony 2.7.30 Sensiolabs Symfony 2.7.31 Sensiolabs Symfony 2.7.32 Sensiolabs Symfony 2.7.33 Sensiolabs Symfony 2.7.34 Sensiolabs Symfony 2.7.35 Sensiolabs Symfony 2.7.36 Sensiolabs Symfony 2.7.37 Sensiolabs Symfony 2.7.38 Sensiolabs Symfony 2.7.39 Sensiolabs Symfony 2.7.40 Sensiolabs Symfony 2.7.41 Sensiolabs Symfony 2.7.42 Sensiolabs Symfony 2.7.43 Sensiolabs Symfony 2.7.44 Sensiolabs Symfony 2.7.45 Sensiolabs Symfony 2.7.46 Sensiolabs Symfony 2.7.47 Sensiolabs Symfony 2.8.0 Sensiolabs Symfony 2.8.1 Sensiolabs Symfony 2.8.2 Sensiolabs Symfony 2.8.3 Sensiolabs Symfony 2.8.4 Sensiolabs Symfony 2.8.5 Sensiolabs Symfony 2.8.6 Sensiolabs Symfony 2.8.7 Sensiolabs Symfony 2.8.8 Sensiolabs Symfony 2.8.9 Sensiolabs Symfony 2.8.10 Sensiolabs Symfony 2.8.11 Sensiolabs Symfony 2.8.12 Sensiolabs Symfony 2.8.13 Sensiolabs Symfony 2.8.14 Sensiolabs Symfony 2.8.15 Sensiolabs Symfony 2.8.16 Sensiolabs Symfony 2.8.17 Sensiolabs Symfony 2.8.18 Sensiolabs Symfony 2.8.19 Sensiolabs Symfony 2.8.20 Sensiolabs Symfony 2.8.21 Sensiolabs Symfony 2.8.22 Sensiolabs Symfony 2.8.23 Sensiolabs Symfony 2.8.24 Sensiolabs Symfony 2.8.25 Sensiolabs Symfony 2.8.26 Sensiolabs Symfony 2.8.27 Sensiolabs Symfony 2.8.28 Sensiolabs Symfony 2.8.29 Sensiolabs Symfony 2.8.30 Sensiolabs Symfony 2.8.31 Sensiolabs Symfony 2.8.32 Sensiolabs Symfony 2.8.33 Sensiolabs Symfony 2.8.34 Sensiolabs Symfony 2.8.35 Sensiolabs Symfony 2.8.36 Sensiolabs Symfony 2.8.37 Sensiolabs Symfony 2.8.38 Sensiolabs Symfony 2.8.39 Sensiolabs Symfony 2.8.40 Sensiolabs Symfony 3.3.0 Sensiolabs Symfony 3.3.1 Sensiolabs Symfony 3.3.2 Sensiolabs Symfony 3.3.3 Sensiolabs Symfony 3.3.4 Sensiolabs Symfony 3.3.5 Sensiolabs Symfony 3.3.6 Sensiolabs Symfony 3.3.7 Sensiolabs Symfony 3.3.8 Sensiolabs Symfony 3.3.9 Sensiolabs Symfony 3.3.10 Sensiolabs Symfony 3.3.11 Sensiolabs Symfony 3.3.12 Sensiolabs Symfony 3.3.13 Sensiolabs Symfony 3.3.14 Sensiolabs Symfony 3.3.15 Sensiolabs Symfony 3.3.16 Sensiolabs Symfony 3.4.0 Sensiolabs Symfony 3.4.1 Sensiolabs Symfony 3.4.2 Sensiolabs Symfony 3.4.3 Sensiolabs Symfony 3.4.4 Sensiolabs Symfony 3.4.5 Sensiolabs Symfony 3.4.6 Sensiolabs Symfony 3.4.7 Sensiolabs Symfony 3.4.8 Sensiolabs Symfony 3.4.9 Sensiolabs Symfony 3.4.10 Sensiolabs Symfony 4.0.0 Sensiolabs Symfony 4.0.1 Sensiolabs Symfony 4.0.2 Sensiolabs Symfony 4.0.3 Sensiolabs Symfony 4.0.4 Sensiolabs Symfony 4.0.5 Sensiolabs Symfony 4.0.6 Sensiolabs Symfony 4.0.7 Sensiolabs Symfony 4.0.8 Sensiolabs Symfony 4.0.9 Sensiolabs Symfony 4.0.10	146
OS	Debian Debian Debian Linux 9.0	1

Common Weakness Enumeration (CWE)

CWE-613 - Insufficient Session Expiration

Nessus

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4262.NASL
description	Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to open redirects, cross-site request forgery, information disclosure, session fixation or denial of service.
last seen	2020-06-01
modified	2020-06-02
plugin id	111535
published	2018-08-06
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111535
title	Debian DSA-4262-1 : symfony - security update

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-EBA0006DF2.NASL
description	Version 2.8.41 (2018-05-25) - bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas) - security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured - security #cve-2018-11406 clear CSRF tokens when the user is logged out - security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation - security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation - security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode ---- Version 2.8.40 (2018-05-21) - bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer
last seen	2020-06-05
modified	2019-01-03
plugin id	120881
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120881
title	Fedora 28 : php-symfony (2018-eba0006df2)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-96D770DDC9.NASL
description	Version 4.0.11 (2018-05-25) - bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (nicolas-grekas) - bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas) - security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured - security #cve-2018-11406 clear CSRF tokens when the user is logged out - security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener - security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation - security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation - security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode - bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (yceruto) - bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (emilielorenzo) ---- Version 4.0.10 (2018-05-21) - bug #27264 [Validator] Use strict type in URL validator (mimol91) - bug #27267 [DependencyInjection] resolve array env vars (jamesthomasonjr) - bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer
last seen	2020-06-05
modified	2019-01-03
plugin id	120636
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120636
title	Fedora 28 : php-symfony4 (2018-96d770ddc9)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-BA0B683C10.NASL
description	Version 3.4.11 (2018-05-25) - bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (nicolas-grekas) - bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas) - security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured - security #cve-2018-11406 clear CSRF tokens when the user is logged out - security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener - security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation - security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation - security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode - bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (yceruto) - bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (emilielorenzo) ---- Version 3.4.10 (2018-05-21) - bug #27264 [Validator] Use strict type in URL validator (mimol91) - bug #27267 [DependencyInjection] resolve array env vars (jamesthomasonjr) - bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer
last seen	2020-06-05
modified	2019-01-03
plugin id	120738
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120738
title	Fedora 28 : php-symfony3 (2018-ba0b683c10)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-C8DDC44BBB.NASL
description	## 3.3.17 (2018-05-25) - security #cve-2018-11407 [Ldap] cast to string when checking empty passwords - security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured - security #cve-2018-11406 clear CSRF tokens when the user is logged out - security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener - security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-07-09
plugin id	110952
published	2018-07-09
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110952
title	Fedora 27 : php-symfony3 (2018-c8ddc44bbb)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-2BDFC9DC67.NASL
description	## 2.8.42 (2018-06-25) - bug #27669 [Filesystem] fix file lock on SunOS (fritzmg) - bug #27309 Fix surrogate not using original request (Toflar) - bug #27630 [Validator][Form] Remove BOM in some xlf files (gautierderuette) - bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (nicolas-grekas) - bug #27581 Fix bad method call with guard authentication + session migration (weaverryan) - bug #27452 Avoid migration on stateless firewalls (weaverryan) - bug #27514 [Debug] Pass previous exception to FatalErrorException (pmontoya) - bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski) - bug #27303 [Process] Consider
last seen	2020-06-05
modified	2018-07-09
plugin id	110949
published	2018-07-09
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110949
title	Fedora 27 : php-symfony (2018-2bdfc9dc67)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

References