GitHub Advisoryadvisory · Packagist

GHSA-j2r4-2cr6-h3r3 Magento Signature verification bypass

HIGH Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2020-9588
Ecosystem
Packagist
Packages
magento/community-edition, magento/core, magento/project-community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-203
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.4-p2 → fixed in 2.3.4-p2 • Packagist magento/core: < 1.9.4.5 → fixed in 1.9.4.5 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.

Related

Alias · CVE (1)

  • CVE-2020-9588 Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing… vulnerability

Weakness · CWE (1)

  • CWE-203 Observable Discrepancy weakness

References