CVE-2014-5244 json
Symfony vulnerable to denial of service via a malicious HTTP Host header
published 2y ago modified 2y ago also GHSA-v77v-x634-9m56
- cvss
- 7.5
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.
This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.
Description When an arbitrarily long hostname is sent by a client, its parsing in `Request::getHost()` can lead to a DoS attack, due to the way we validate the hostname via a regular expression.
Resolution The regular expression used to parse and validate the hostname from the HTTP request has been modified to avoid too much sensitivity to the submitted value length.
The patch for this issue is available here: https://github.com/symfony/symfony/pull/11828
Patch / fix
- packagist symfony/http-foundation 2.3.19, 2.4.9, 2.5.4
- packagist symfony/symfony 2.3.19, 2.4.9, 2.5.4
- github.com/symfony/symfony@1ee96a8 commit
- github.com/symfony/symfony#11828 pull request
Is CVE-2014-5244 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symfony/http-foundation | >=2.0.0, <2.3.19 >=2.4.0, <2.4.9 >=2.5.0, <2.5.4 |
2.3.19 2.4.9 2.5.4 |
| packagist | symfony/symfony | >=2.0.0, <2.3.19 >=2.4.0, <2.4.9 >=2.5.0, <2.5.4 |
2.3.19 2.4.9 2.5.4 |
Classification
- Weakness
-
- CWE-1333 Inefficient Regular Expression Complexity
References
-
github.com
/symfony/symfony/pull/11828
web
-
github.com
/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-5244.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-5244.yaml
web
-
symfony.com
/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header
web
-
symfony.com
/cve-2014-5244
web
Sources
- GitHub Advisory GHSA-v77v-x634-9m56
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.