GHSA-j2r4-2cr6-h3r3

Magento Signature verification bypass

En bref

Publiée: 2022-05-24 17:21 UTC
Mise à jour: 2025-02-10 20:41 UTC
CVE: CVE-2020-9588
Alias: BIT-magento-2020-9588
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Paquets affectés

Paquet	Versions
Packagist · magento/community-edition	introduced 0, fixed 2.3.4-p2
Packagist · magento/core	introduced 0, fixed 1.9.4.5
Packagist · magento/project-community-edition	introduced 0, last affected 2.0.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-9588 ADVISORY
https://helpx.adobe.com/security/products/magento/apsb20-22.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database