CVE-2019-7858: High severity centos libgcc vulnerability
A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks.
Other sources
PRODSECBUG-2172: Insecure user credential storage
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7858?
CVE-2019-7858 is considered to have a high severity due to its potential for brute force attacks on sensitive information.
Which versions of Magento are affected by CVE-2019-7858?
CVE-2019-7858 affects Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2.
How do I fix CVE-2019-7858?
To fix CVE-2019-7858, upgrade to Magento versions 2.1.18, 2.2.9, or 2.3.2 or later.
What kind of information is compromised in CVE-2019-7858?
CVE-2019-7858 can lead to the storage of sensitive user credentials in an insecure manner.
Is there a patch available for CVE-2019-7858?
Yes, Magento has released security updates that address CVE-2019-7858 in the specified versions.