GHSA-9mpf-g3fc-9rgv FriendsOfSymfony FOSUserBundle denial of service via login form

• Packagist friendsofsymfony/user-bundle: >= 1.2.0, < 1.2.5 → fixed in 1.2.5 • Packagist friendsofsymfony/user-bundle: >= 1.3.0, < 1.3.3 → fixed in 1.3.3

The login form in the FriendsOfSymfony FOSUserBundle bundle before 1.3.3 for Symfony allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation.