-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2587
APSB20-47 Security updates available for Magento
29 July 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Magento Commerce 2
Magento Open Source 2
Publisher: Adobe
Operating System: Linux variants
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Scripting -- Remote/Unauthenticated
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-9692 CVE-2020-9691 CVE-2020-9690
CVE-2020-9689
Original Bulletin:
https://helpx.adobe.com/security/products/magento/apsb20-47.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Security Updates Available for Magento | APSB20-47
+------------------------+---------------------------------+------------------+
|Bulletin ID |Date Published |Priority |
+------------------------+---------------------------------+------------------+
|ASPB20-47 |July 28th, 2020 |2 |
+------------------------+---------------------------------+------------------+
Summary
Magento has released updates for Magento Commerce2(formerly known as Magento
Enterprise Edition) and Magento Open Source2 (formerly known as Magento
Community Edition).These updates resolve vulnerabilities rated Important and
Critical . Successful exploitation could lead to arbitrary code execution and
signature verification bypass.
Affected Versions
+-------------------------+-----------------------------+--------+
| Product | Version |Platform|
+-------------------------+-----------------------------+--------+
|Magento Commerce 2 |2.3.5-p1 and earlier versions|All |
+-------------------------+-----------------------------+--------+
|Magento Open Source 2 |2.3.5-p1 and earlier versions|All |
+-------------------------+-----------------------------+--------+
Solution
Adobe categorizes these updates with the following priority ratings and
recommends users update their installation to the newest version.
+--------------------+--------------+--------+--------------+----------------+
|Product |Updated |Platform|Priority |Release Notes |
| |Version | |Rating | |
+--------------------+--------------+--------+--------------+----------------+
|Magento Commerce 2 |2.4.0 |All |2 |2.4.0 Commerce |
+--------------------+--------------+--------+--------------+----------------+
|Magento Open Source |2.4.0 |All |2 |2.4.0 Open |
|2 | | | |Source |
+--------------------+--------------+--------+--------------+----------------+
+--------------------+--------------+--------+--------------+----------------+
|Magento Commerce 2 |2.3.5-p2 |All |2 |N/A |
+--------------------+--------------+--------+--------------+----------------+
|Magento Open Source |2.3.5-p2 |All |2 |N/A |
|2 | | | | |
+--------------------+--------------+--------+--------------+----------------+
Vulnerability details
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
| | | | |Admin | | |
|Vulnerability Category |VulnerabilityImpact|Severity |Pre-authentication |privileges|Magento Bug ID |CVE numbers |
| | | | |required | | |
| | | | | | | |
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
|Path Traversal |Arbitrary code |Critical |No |Yes |PRODSECBUG-2716|CVE-2020-9689 |
| |execution | | | | | |
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
|Observable Timing |Signature |Important|No |Yes |PRODSECBUG-2726|CVE-2020-9690 |
|Discrepancy |verification bypass| | | | | |
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
|DOM-based Cross-Site |Arbitrary code |Important|Yes |No |PRODSECBUG-2533|CVE-2020-9691 |
|Scripting |execution | | | | | |
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
|SecurityMitigationbypass|Arbitrary code |Critical |No |Yes |PRODSECBUG-2769|CVE-2020-9692 |
| |execution | | | | | |
+------------------------+-------------------+---------+-------------------+----------+---------------+---------------------+
Note:
Pre-authentication: The vulnerability is exploitable without credentials.
Admin privileges required: The vulnerability is only exploitable by an attacker
with administrative privileges.
Acknowledgments
Adobe would like to thank the following individuals for reporting the relevant
issues and for working with Adobe to help protect our customers:
o Edgar Boda-Majer ofBugscale and Blaklis (CVE-2020-9689)
o WasinSae-ngow(CVE-2020-9690)
o LinusSarud(CVE-2020-9691)
o Edgar Boda-Majer ofBugscale (CVE-2020-9692)
Revisions
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXyEWH+NLKJtyKPYoAQiK1w//bW5fUZCjt7d9kZ/W7QN5lM4NJu2gmSSB
YUsNfkxmDTCddgKLTifA9GHFVLFJ+MhjM+9R7Nzj5tvukYFmgGNQbVOH2cUXLkQV
nYQLlL6Jj15+ZNlaJQgnEalpW+/NNrkQE34L6akGN6ijfIF8XhtPWyrc2kRFte1c
XlJT/iHng9OUjPWm/2/+CmsdJKX9ZdCVU8nByC71t96V1c+FtbB2+RMHckcMErgX
MMSsfPPygPrq4iLTPe0v2lPl7diH4pZ3oXRS5QnErxXaPsrJuVk0bkM1COFhkXdp
OvaeAAdlTX4QuUtRmAnwEr/kS3jvbdPsn5NXOBCIDTCBvhu5GbysH+DSKedBW5MV
D0FwWu6Vi60fcbWKCGo+tCAL7JdCMepAXlZTeODKOOfmnPXxXgFNtge4KTr5JfBn
oFCDk7FTZ7V9g6EdcEDoFhvrkkUk73UZdgOYIklosbrWwdz3l/Bj1WDvkqCVZdW2
oARUSC2/5w2Sqq6npVr5Mdvp7kL0WBu1YDKp1O9ZEPHCwdKsS7dyb3sItx6reWqJ
e1sx8xhsKLI3Qd76xAft/faAdx0mwzwPKEcgz1BTAU6DzxDIyFlqW8aH7HygmG2a
UdeYFwZETLEelYr9uGFc7Z2f0YbBDXgSFO11xLa99kXyZS4Lq+HVh3g2O9AQWIHr
pMuJqYXC0xE=
=yzTy
-----END PGP SIGNATURE-----
https://www.malwaredevil.com/2020/07/29/esb-2020-2587-alert-linux-magento-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2020-2587-alert-linux-magento-multiple-vulnerabilities
No comments:
Post a Comment