Today we learned that Magento has a new vulnerability. They call it NEW ZEND FRAMEWORK 1 SECURITY VULNERABILITY.
It's described as follow here:
To protect your site from this vulnerability, you should immediately check your mail sending settings. Go to the system settings used to control the “Reply to” address for emails sent from your Magento store:
Magento 1: System-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path
Magento 2: Stores-> Configuration-> Advanced-> System-> Mail Sending Settings-> Set Return-Path
If “Set Return-Path” is set to “Yes,” and your server uses Sendmail, then your store is vulnerable to this exploit. Enterprise Cloud Edition customers do not need to worry about this issue. We’ve already checked your configuration and you are not at risk.
Currently I have settings for Set Return-Path
as Specified
in my EE.
Magento suggests
Enterprise Cloud Edition customers do not need to worry about this issue
and also
set it to NO
I am a little confused what to do till the patch arrives.
Am I vulnerable?