Add advisory for Laravel cookie serialization vulnerability

[byCedric]

As mentioned in the official docs and Laravel News. The merged pull request containing the fix for 5.6.x branch is over here. And the commit for the 5.5.x branch is either this one, the parent of that one or the parent-of-the-parent.

[BackEndTea]

I think this should also include the illuminate/cookie repo.

[byCedric]

@BackEndTea You are right, added it to illuminate/cookie too! Thanks, almost missed that one.

[ottowayne]

I think this affects Laravel 4 too: https://github.com/laravel/framework/blob/4.2/src/Illuminate/Encryption/Encrypter.php#L98

Back then you weren't even able to tell the Encrypter not to use serialization. The switch wasn't introduced until 2 years ago: laravel/framework@9725a8e

[byCedric]

@ottowayne Ah, yeah, I was thinking "its a middleware in which the vulnerability exists, and that wasn't introduced before 5.x".

I think you are right here too, I will add the whole 4.x.x range to illuminate/cookie too. It's using illuminate/encryption in the insecure way. I don't think we have to add this library too right? Because the issue is only scoped to deserializing cookies, or am I missing something?

[Ocramius]

Only what actually causes a security issue should be added here

…

On Fri, 10 Aug 2018, 10:43 Cedric van Putten, ***@***.***> wrote: @ottowayne <https://github.com/ottowayne> Ah, yeah, I was thinking "its a middleware in which the vulnerability exists, and that wasn't introduced before 5.x". I think you are right here too, I will add the whole 4.x.x range to illuminate/cookie too. It's using illuminate/encryption in the insecure way. I don't think we have to add this library too right? Because the issue is only scoped to deserializing cookies, or am I missing something? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#315 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJakOnb9Fgki1TFeUHbcAwRLyEkPkBfks5uPTm1gaJpZM4V1iDx> .

[byCedric]

Ok, thanks, I guess this is it then! 😀

[ottowayne]

Yes, I thought about illuminate/encryption, too. In my opinion it was unfortunately designed, but it doesn't have a security issue by itself.

I guess that developers might not have known that stuff that got thrown in there will be serialized and are using it to encrypt user input.