Bug 418427 – <dev-php/symfony-1.4.18 Session fixation vulnerability (CVE-2012-2667)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Laurent Bachelier 2012-05-31 19:07:46 UTC]

+++ This bug was initially created as a clone of Bug #407427 +++

1.4.18 is out
http://symfony.com/blog/security-release-symfony-1-4-18-released

No changes in the ebuild code should be necessary. Contains only security/bugfixes.

[Comment 1 Jamie Learmonth 2012-06-01 17:07:39 UTC]

This is good to bump with a simple version bump.

https://raw.github.com/jamiel/gentoo-overlay/master/dev-php/symfony/symfony-1.4.18.ebuild

[Comment 2 Paweł Hajdan, Jr. (RETIRED) 2012-06-02 14:31:53 UTC]

This is a security issue, so should be handled by security@

[Comment 3 Paweł Hajdan, Jr. (RETIRED) 2012-06-02 15:49:09 UTC]

+*symfony-1.4.18 (02 Jun 2012)
+
+  02 Jun 2012; Pawel Hajdan jr +symfony-1.4.18.ebuild:
+  Version bump wrt security bug #418427.

Ebuild in tree, OK to stabilize?

[Comment 4 GLSAMaker/CVETool Bot 2012-06-15 19:43:59 UTC]

CVE-2012-2667 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2667):
  Session fixation vulnerability in lib/user/sfBasicSecurityUser.class.php in
  SensioLabs Symfony before 1.4.18 allows remote attackers to hijack web
  sessions via vectors related to the regenerate method and unspecified
  "database backed session classes."

[Comment 5 Agostino Sarubbo 2012-09-28 12:51:31 UTC]

vulnerable version removed. please vote.

[Comment 6 Tim Sammut (RETIRED) 2012-10-02 06:38:45 UTC]

Thanks, folks. GLSA Vote: no.

[Comment 7 Sean Amoss (RETIRED) 2012-11-26 00:49:56 UTC]

Please do not close security bugs. 

GLSA vote: no. 

Leaving resolved, moving to noglsa.