CVE-2016-1902 Symfony Cryptographic Vulnerability
Attackers can defeat cryptographic protections in Symfony due to weak random number generation when specific PHP conditions are met.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-1902?
CVE-2016-1902 is a high-severity vulnerability in Debian Debian Linux, published on 1 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Weakness: CWE-310
Which versions are affected by CVE-2016-1902?
16 open source packages ship an affected version, including symfony/security, symfony/security-core and symfony/symfony. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security Packagist | From 2.3.0 | 2.3.37 |
symfony/security Packagist | From 2.3.0 | 2.3.37 |
symfony/security Packagist | From 2.4.0 | 2.6.13 |
symfony/security Packagist | From 2.4.0 | 2.6.13 |
symfony/security Packagist | From 2.7.0 | 2.7.9 |
symfony/security Packagist | From 2.7.0 | 2.7.9 |
10 more packages
symfony/security-core Packagist | From 2.4.0 | 2.6.13 |
symfony/security-core Packagist | From 2.4.0 | 2.6.13 |
symfony/security-core Packagist | From 2.7.0 | 2.7.9 |
symfony/security-core Packagist | From 2.7.0 | 2.7.9 |
symfony/symfony Packagist | From 2.3.0 | 2.3.37 |
symfony/symfony Packagist | From 2.3.0 | 2.3.37 |
symfony/symfony Packagist | From 2.4.0 | 2.6.13 |
symfony/symfony Packagist | From 2.4.0 | 2.6.13 |
symfony/symfony Packagist | From 2.7.0 | 2.7.9 |
symfony/symfony Packagist | From 2.7.0 | 2.7.9 |
Products include Debian Debian Linux, Sensiolabs Symfony.
How do I fix CVE-2016-1902?
Upgrade symfony/security to a fixed version for your release line: 2.3.37, 2.6.13 or 2.7.9.
Is CVE-2016-1902 being exploited?
There is no known exploitation of CVE-2016-1902 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-1902, GHSA-jjx5-fq5g-8xpc.