Homepage
About Snyk

Insecure Randomness Affecting symfony/symfony package, versions >=2.3.0, <2.3.37 >=2.6.0, <2.6.13 >=2.4.0, <2.5.0 >=2.7.0, <2.7.9 >=2.5.0, <2.6.0

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.17% (54th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PHP-SYMFONYSYMFONY-70220
  • published 14 Jan 2016
  • disclosed 14 Jan 2016
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 14 Jan 2016

CVE-2016-1902 Open this link in a new tab
CWE-330 Open this link in a new tab

How to fix?

Upgrade symfony/symfony to version 2.3.37, 2.6.13, 2.5.0, 2.7.9, 2.6.0 or higher.

Overview

Affected versions of symfony/symfony are vulnerable to Insecure Randomness .

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.