Skip to content
Fencer Intel
critical —

GHSA-98j6-67v3-mw34 json

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

published last yr. modified 9mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

**Overview** The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

**Am I Affected?** You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0. 2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

**Fix** Upgrade Auth0/symfony to the latest version (v5.4.0).

**Acknowledgement** Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Patch / fix

  • packagist auth0/symfony 5.1.0

Is GHSA-98j6-67v3-mw34 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist auth0/symfony
>=5.0.0-BETA0, <5.1.0
5.1.0

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.