Cookie persistence after password changes in symfony/security-bundle
Description
Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password.
Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.
Resolution
Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.
The patch for this issue is available here for branch 5.3.
Credits
We would like to thank Thibaut Decherit for reporting the issue and Wouter J for fixing the issue.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | symfony/security-bundle | >= 5.3.0, < 5.3.12 | 5.3.12 |
| Paquete de Composer | symfony/symfony | >= 5.3.0, < 5.3.12 | 5.3.12 |
Referencias
- https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqr
- https://nvd.nist.gov/vuln/detail/CVE-2021-41268
- https://github.com/symfony/symfony/pull/44243
- https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2021-41268.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41268.yaml
- https://github.com/symfony/symfony
- https://github.com/symfony/symfony/releases/tag/v5.3.12
- https://symfony.com/cve-2021-41268
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-384- Plataforma
- Composer
- Paquete
symfony/security-bundle, symfony/symfony- Publicada
- 24.11.2021
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-qw36-p97w-vcqr - CC BY 4.0
Historial de vulnerabilidades: symfony/security-bundle
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 11.2021 11.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 1
- Media 3
- Baja 1
Divulgaciones por año
- 2021: 1
- 2022: 2
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 0
-
Cookie persistence after password changes in symfony/security-bundle esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.