Insecure Randomness Affecting symfony/symfony package, versions >=2.3.0, <2.3.37 >=2.6.0, <2.6.13 >=2.4.0, <2.5.0 >=2.7.0, <2.7.9 >=2.5.0, <2.6.0
Threat Intelligence
EPSS
0.17% (55th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-SYMFONYSYMFONY-70220
- published 14 Jan 2016
- disclosed 14 Jan 2016
- credit Unknown
Introduced: 14 Jan 2016
CVE-2016-1902 Open this link in a new tabHow to fix?
Upgrade symfony/symfony to version 2.3.37, 2.6.13, 2.5.0, 2.7.9, 2.6.0 or higher.
Overview
Affected versions of symfony/symfony are vulnerable to Insecure Randomness .
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
References
CVSS Scores
version 3.1