| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | ≥ 2.0, < 2.2.6 | 2.2.6 |
| magento/project-community-edition | ≥ 2.0, ≤ 2.0.2 |
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free