Description
The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | friendsofsymfony/user-bundle | >= 1.2.0, < 1.2.5 | 1.2.5 | GHSA-9mpf-g3fc-9rgv |
| Packagist | friendsofsymfony/user-bundle | >= 1.3.0, < 1.3.3 | 1.3.3 | GHSA-9mpf-g3fc-9rgv |