CVE-2019-8135: Critical severity centos libgcc vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
Other sources
PRODSECBUG-2417: Remote code execution via vulnerable Symphony dependecy injection
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8135?
CVE-2019-8135 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2019-8135?
To fix CVE-2019-8135, users should upgrade to Magento version 2.2.10 or higher and version 2.3.3 or higher.
Which versions of Magento are affected by CVE-2019-8135?
CVE-2019-8135 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1.
What type of vulnerability is CVE-2019-8135?
CVE-2019-8135 is a remote code execution vulnerability due to dependency injection issues in the Symphony framework.
What are the consequences of CVE-2019-8135 being exploited?
If exploited, CVE-2019-8135 could allow attackers to execute arbitrary code on the server running affected Magento versions.