GHSA-pjx8-984p-7p3x: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-pjx8-984p-7p3x) affects FOSUserBundle, a PHP package, where entropy is lost in the TokenGenerator component. The issue was discovered in versions 1.0.x through 1.3.x (prior to 1.3.5) and was disclosed on September 4, 2014. The vulnerability impacts the token generation mechanism used for email confirmation and password resetting functionalities (GitHub Advisory, Symfony Blog).

The vulnerability stems from the usage of base_convert function which loses precision for large inputs, resulting in reduced entropy of generated tokens. The implementation used base_convert(bin2hex($randomNumber), 16, 36) which compromised the cryptographic safety of the tokens. The issue has been assigned a moderate severity rating and is categorized under CWE-331 (GitHub Advisory, FOSUserBundle Commit).

The vulnerability results in tokens being much less random than expected, compromising their cryptographic safety. This affects the security of email confirmation and password reset functionalities, potentially making these tokens more predictable than intended (Symfony Blog).

The issue was fixed in FOSUserBundle version 1.3.5 by backporting the token generation logic from the 2.0.x branch, which uses base64 encoding instead. The fix requires updating route placeholders that match tokens to allow dashes, changing the regex pattern from \w+ to [\w-]+. No fixes were provided for versions 1.0, 1.1, and 1.2 as they were no longer maintained (Symfony Blog).