Advisory Database
  • Advisories
  • Dependency Scanning
  1. composer
  2. ›
  3. laravel/framework
  4. ›
  5. GMS-2018-27

GMS-2018-27: Unsafe payload decryption

March 30, 2018

There’s a potential exploit of the Laravel Encrypter component that may cause the Encrypter to fail on decryption and unexpectedly return false. To exploit this, the attacker must be able to modify the encrypted payload before it is decrypted. This could lead to unexpected behavior when combined with weak type comparisons.

References

  • medium.com/@taylorotwell/laravel-security-release-5-6-15-and-5-5-40-56f1257933a0

Code Behaviors & Features

Detect and mitigate GMS-2018-27 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 5.5.40, all versions starting from 5.6.0-alpha0 before 5.6.15

Fixed versions

  • v5.5.40
  • v5.6.15

Solution

Upgrade to versions v5.5.40, v5.6.15 or above.

Source file

packagist/laravel/framework/GMS-2018-27.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:59 +0000.