Medium · 5.9 CVE-2017-14775 EUVD-2022-3480GHSA-c2v7-j5gq-wcq4

Laravel Sensitive Data Exposure

Published Sep 27, 2017 · Updated Sep 17, 2024 · Assigned by mitre

Package: illuminate/auth Package: laravel/framework Ecosystem: Packagist

Description

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	illuminate/auth	< 5.5.10	5.5.10	GHSA-c2v7-j5gq-wcq4
Packagist	laravel/framework	< 5.5.10	5.5.10	GHSA-c2v7-j5gq-wcq4

References

https://github.com/laravel/framework/releases/tag/v5.5.10
https://github.com/laravel/framework/pull/21320
https://laravel-news.com/laravel-v5-5-11