GHSA-hmch-9947-82rj
Magento 2 Community Edition Weak Cryptography
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | >= 2.1.0, < 2.1.19 | 2.1.19 |
| Packagist | magento/community-edition | >= 2.2.0, < 2.2.10 | 2.2.10 |
| Packagist | magento/community-edition | >= 2.3.0, < 2.3.3 | 2.3.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-8118
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8118.yaml
- https://github.com/magento/magento2
- https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
- https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update