p PatchFirst

GHSA-9wg9-93h9-j8ch

GHSA-9wg9-93h9-j8ch · Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

**Overview** Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. **Am I Affected?** You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 symfony SDK with version <=5.3.1 2. Auth0/Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0. 3. Session storage configured with CookieStore. **Fix** Upgrade Auth0/symfony to v5.4.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. **Acknowledgement** Okta would like to thank Félix Charette for discovering this vulnerability.

CVSS 9.1 · Crítica · Corrección disponible

Publicación
Actualización

Pila tecnológica: php

Productos y versiones afectados

  • auth0/symfony Packagist

    Versiones
    • 0.0.1
    • 0.0.2
    • 0.0.3
    • 1.0.0
    • 1.2.0
    • 1.2.1
    • 1.2.10
    • 1.2.2
    • 1.2.3
    • 1.2.4
    • 1.2.5
    • 1.2.6
    • 1.2.7
    • 1.2.8
    • 1.2.9
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 3.0.0
    • 3.0.0-beta.1
    • 3.0.0-beta.2
    • 3.0.0-beta.3
    • 3.0.0-beta.4
    • 3.0.0-beta.5
    • 3.0.0-rc.1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.4.0
    • 4.0.0
    • 5.0.0
    • 5.0.0-BETA0
    • 5.0.0-BETA1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.2.2
    • 5.2.3
    • 5.3.0
    • 5.3.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 5.4.0

    Actualiza a 5.4.0

Fuentes originales

Comprueba tu servidor →