CVE-2019-8136: Critical severity centos libgcc vulnerability

Q: What is the severity of CVE-2019-8136?

CVE-2019-8136 is considered a medium severity vulnerability that affects specific versions of Magento.

Q: How do I fix CVE-2019-8136?

To remediate CVE-2019-8136, upgrade Magento to version 2.2.10 or 2.3.3 or later versions.

Q: Which versions of Magento are affected by CVE-2019-8136?

CVE-2019-8136 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3.

Q: What type of vulnerability is CVE-2019-8136?

CVE-2019-8136 is classified as an insecure component vulnerability within the Magento platform.

Q: Is there a patch available for CVE-2019-8136?

Yes, patches are available in the updated versions of Magento, specifically 2.2.10 and 2.3.3.

Published Oct 8, 2019

Updated

An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component.

Other sources

PRODSECBUG-2416: Using vulnerable component that provides abstraction of HTTP specification

Affected Software

9 affected componentsFixes available

composer/magento/product-community-edition>=2.2, <2.2.10, >=2.3, <2.3.2-p2

composer/magento/community-edition>=2.3.0<2.3.2-p1

2.3.2-p1

composer/magento/community-edition>=2.2.0<2.2.10

2.2.10

Magento Magento>=2.2.0<2.2.10

Magento Magento>=2.3.0<2.3.2

Magento Magento=2.3.2

Remediation

Patch Available

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Event History

Oct 8, 2019

Advisory Published

12:00 AM

Nov 5, 2019

CVE Published

via MITRE·11:18 PM

Data Sourced

via MITRE·11:18 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-8136?