VDB
Sign up
HIGH7.5

GHSA-cgfj-hj93-rmh2

Shopware allows Denial Of Service via password length

Quick fix

GHSA-cgfj-hj93-rmh2 — shopware/core: upgrade to the fixed version with the command below.

composer require shopware/core:^6.6.10.3

Details

### Impact

It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API.

### Patches Update to Shopware 6.6.10.3 or 6.5.8.17

### Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/shopware/core
Introduced in: 6.6.0.0Fixed in: 6.6.10.3
Fixcomposer require shopware/core:^6.6.10.3
Packagist/shopware/platform
Introduced in: 6.6.0.0Fixed in: 6.6.10.3
Fixcomposer require shopware/platform:^6.6.10.3
Packagist/shopware/core
Introduced in: 6.7.0.0-rc1Fixed in: 6.7.0.0-rc2
Fixcomposer require shopware/core:^6.7.0.0-rc2
Packagist/shopware/platform
Introduced in: 6.7.0.0-rc1Fixed in: 6.7.0.0-rc2
Fixcomposer require shopware/platform:^6.7.0.0-rc2
Packagist/shopware/core
Introduced in: 0Fixed in: 6.5.8.17
Fixcomposer require shopware/core:^6.5.8.17
Packagist/shopware/platform
Introduced in: 0Fixed in: 6.5.8.17
Fixcomposer require shopware/platform:^6.5.8.17

References