{"action":"Upgrade symfony/symfony to 2.3.35 or later.","affected":[{"fixed":"2.3.35","introduced":"2.3.0"},{"fixed":"2.7.7","introduced":"2.7.0"},{"fixed":"2.6.12","introduced":"2.4.0"}],"component":"symfony/symfony","cve_ids":["CVE-2015-8125"],"ecosystem":"Packagist","epss":0.02545,"exploited":false,"fixed_versions":["2.3.35","2.7.7","2.6.12"],"ghsa_id":"GHSA-g97c-jfx6-xvxh","id":"tcs_01M5KF2HT73BYPKQP32WB3XVEF","modified_at":"2024-11-30T05:38:39.146840Z","published_at":"2022-05-17T03:25:24Z","references":["https://osv.dev/vulnerability/GHSA-g97c-jfx6-xvxh","https://nvd.nist.gov/vuln/detail/CVE-2015-8125","https://github.com/symfony/symfony/pull/16630","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2015-8125.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2015-8125.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2015-8125.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-8125.yaml","https://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service","https://symfony.com/cve-2015-8125","https://web.archive.org/web/20200228050051/http://www.securityfocus.com/bid/77692","http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173271.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173300.html","http://www.debian.org/security/2015/dsa-3402","http://www.securityfocus.com/bid/77692"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-g97c-jfx6-xvxh","url":"https://osv.dev/vulnerability/GHSA-g97c-jfx6-xvxh"}],"summary":"Symfony Vulnerable to Timing Attack"}