CVE-2021-21426: Fixes a bug in Zend Framework's Stream HTTP Wrapper

Q: What is CVE-2021-21426?

CVE-2021-21426 is a vulnerability in Magento-lts versions 19.4.12 and prior and 20.0.8 and prior.

Q: What is the severity of CVE-2021-21426?

The severity of CVE-2021-21426 is critical with a CVSS score of 9.8.

Q: How does CVE-2021-21426 affect Magento-lts?

CVE-2021-21426 affects Magento-lts versions 19.4.12 and prior and 20.0.8 and prior.

Q: How can I fix CVE-2021-21426?

To fix CVE-2021-21426, update to versions 19.4.13 and 20.0.9 of Magento-lts.

Q: Is there a patch available for CVE-2021-21426?

Yes, a patch is available in versions 19.4.13 and 20.0.9 of Magento-lts.

Published Apr 21, 2021

Updated

Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework.

Affected Software

2 affected components

OpenMage Magento<19.4.13

OpenMage Magento>=20.0.0<20.0.9

Event History

Apr 21, 2021

CVE Published

via MITRE·08:15 PM

Data Sourced

via MITRE·08:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-21426?

CVE-2021-21426 is a vulnerability in Magento-lts versions 19.4.12 and prior and 20.0.8 and prior.

What is the severity of CVE-2021-21426?

The severity of CVE-2021-21426 is critical with a CVSS score of 9.8.

How does CVE-2021-21426 affect Magento-lts?