GHSA-hmch-9947-82rj
Magento 2 Community Edition Weak Cryptography
At a glance
- Published
- Updated
- CVE
- CVE-2019-8118
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.19 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.10 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-8118 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8118.yaml WEB
- https://github.com/magento/magento2 PACKAGE
- https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update WEB
- https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |