UBUNTU-CVE-2017-16653
- Source
- https://ubuntu.com/security/CVE-2017-16653
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-16653.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2017-16653
- Upstream
- Published
- 2018-08-06T21:29:00Z
- Modified
- 2025-10-24T04:46:36Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Ubuntu - medium
- Summary
- [none]
- Details
-
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
- References
Affected packages
Ubuntu:16.04:LTS / symfony
Package
- Name
- symfony
- Purl
- pkg:deb/ubuntu/symfony@2.7.10-0ubuntu2?arch=source&distro=xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Ecosystem specific
{
"binaries": [
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-asset"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-browser-kit"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-class-loader"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-config"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-console"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-css-selector"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-debug"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-debug-bundle"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-dependency-injection"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-doctrine-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-dom-crawler"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-event-dispatcher"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-expression-language"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-filesystem"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-finder"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-form"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-framework-bundle"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-http-foundation"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-http-kernel"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-intl"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-locale"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-monolog-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-options-resolver"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-phpunit-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-process"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-property-access"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-proxy-manager-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-routing"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-security"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-security-bundle"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-serializer"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-stopwatch"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-swiftmailer-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-templating"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-translation"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-twig-bridge"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-twig-bundle"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-validator"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-var-dumper"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-web-profiler-bundle"
},
{
"binary_version": "2.7.10-0ubuntu2",
"binary_name": "php-symfony-yaml"
}
]
}