CVE-2019-7860: Weak RNG
A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Other sources
PRODSECBUG-2174: Use of insufficiently random values in multiple security relevant contexts
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7860?
CVE-2019-7860 is considered a moderate severity vulnerability due to the use of a cryptographically weak pseudo-random number generator.
What products are affected by CVE-2019-7860?
CVE-2019-7860 affects Magento 2.1 versions prior to 2.1.18, Magento 2.2 versions prior to 2.2.9, and Magento 2.3 versions prior to 2.3.2.
How do I fix CVE-2019-7860?
To fix CVE-2019-7860, upgrade your Magento installation to version 2.1.18, 2.2.9, or 2.3.2, depending on your current version.
What are the potential consequences of CVE-2019-7860?
The consequences of CVE-2019-7860 include potential exposure to security risks due to insufficient randomness in cryptographic operations.
Is there a patch for CVE-2019-7860?
Yes, security updates have been released that can be applied to patch CVE-2019-7860 for the affected versions of Magento.