From 4ba00172fc1fd92cfd9bd920ac10419dd98a6a7a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 12 Feb 2024 12:01:28 +0000
Subject: [PATCH] Publish GHSA-3q5x-7mxp-rp6j

---
 .../2019/11/GHSA-3q5x-7mxp-rp6j/GHSA-3q5x-7mxp-rp6j.json    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/advisories/github-reviewed/2019/11/GHSA-3q5x-7mxp-rp6j/GHSA-3q5x-7mxp-rp6j.json b/advisories/github-reviewed/2019/11/GHSA-3q5x-7mxp-rp6j/GHSA-3q5x-7mxp-rp6j.json
index 0de25c2a541..2431204dac0 100644
--- a/advisories/github-reviewed/2019/11/GHSA-3q5x-7mxp-rp6j/GHSA-3q5x-7mxp-rp6j.json
+++ b/advisories/github-reviewed/2019/11/GHSA-3q5x-7mxp-rp6j/GHSA-3q5x-7mxp-rp6j.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3q5x-7mxp-rp6j",
-  "modified": "2021-08-18T22:23:57Z",
+  "modified": "2024-02-12T11:59:17Z",
   "published": "2019-11-12T22:59:32Z",
   "aliases": [
     "CVE-2019-8135"
   ],
   "summary": "Remote code execution via vulnerable Symphony dependecy injection",
-  "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.",
+  "details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -47,7 +47,7 @@
               "introduced": "2.3"
             },
             {
-              "fixed": "2.3.3"
+              "fixed": "2.3.2-p2"
             }
           ]
         }