CVE-2019-8122: High severity centos libgcc vulnerability

Q: What is the severity of CVE-2019-8122?

CVE-2019-8122 is classified as a critical remote code execution vulnerability affecting specific versions of Magento.

Q: How do I fix CVE-2019-8122?

To fix CVE-2019-8122, upgrade Magento to version 2.1.19, 2.2.10, or 2.3.3 or later.

Q: Who is affected by CVE-2019-8122?

CVE-2019-8122 affects authenticated users with privileges to create products on Magento versions prior to the recommended fixed versions.

Q: What can attackers achieve with CVE-2019-8122?

Attackers exploiting CVE-2019-8122 can perform remote code execution, potentially compromising the security of the Magento installation.

Q: Is CVE-2019-8122 present in all Magento installations?

No, CVE-2019-8122 is only present in specific affected versions of Magento prior to the security updates.

Published Oct 8, 2019

Updated

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution.

Other sources

PRODSECBUG-2446: Remote code execution via custom layout update in create product functionality

Affected Software

10 affected componentsFixes available

composer/magento/product-community-edition>=2.2, <2.2.10, >=2.3, <2.3.2-p2

composer/magento/community-edition>=2.3.0<2.3.3

2.3.3

composer/magento/community-edition>=2.2.0<2.2.10

2.2.10

composer/magento/community-edition>=2.1.0<2.1.19

2.1.19

Magento Magento>=2.1.0<2.1.19

Magento Magento>=2.2.0<2.2.10

Magento Magento>=2.3.0<=2.3.2

Remediation

Patch Available

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Event History

Oct 8, 2019

Advisory Published

12:00 AM

Nov 5, 2019

CVE Published

via MITRE·10:50 PM

Data Sourced

via MITRE·10:50 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-8122?