CVE-2019-8121: Using JS libraries with known security vulnerabilities

CVE-2019-8121 · Severity: info · Published 2019-11-12

Using JS libraries with known security vulnerabilities

Technologies: magento/community-edition (Packagist), magento/product-community-edition (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2019-8121 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-8121 being exploited in the wild.
How severe is CVE-2019-8121?
Informational severity, published 12 November 2019.
Which products and versions are affected?
magento/community-edition (Packagist) ECOSYSTEM:introduced=2.2,fixed=2.2.10; magento/product-community-edition (Packagist) ECOSYSTEM:introduced=2.2,fixed=2.2.10.
Is there a fix for CVE-2019-8121?
Yes. magento/community-edition (Packagist): upgrade to 2.2.10 or later; magento/product-community-edition (Packagist): upgrade to 2.2.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2019-8121?
Check whether you run magento/community-edition (Packagist) or magento/product-community-edition (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • magento/community-edition (Packagist): upgrade to 2.2.10 or later
    composer require magento/community-edition:^2.2.10
  • magento/product-community-edition (Packagist): upgrade to 2.2.10 or later
    composer require magento/product-community-edition:^2.2.10

Affected products

  • magento/community-edition (Packagist) ECOSYSTEM:introduced=2.2,fixed=2.2.10
  • magento/product-community-edition (Packagist) ECOSYSTEM:introduced=2.2,fixed=2.2.10

Identifiers

  • CVE-2019-8121
  • GHSA-89ch-hqf9-rgp3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.