DocumentationCommerceRelease information

Adobe Commerce 2.4.3-p2 release notes

Last update: Fri Apr 21 2023 00:00:00 GMT+0000 (Coordinated Universal Time)

CREATED FOR:

  • Experienced
  • Admin
  • Developer

Adobe Commerce 2.4.3-p2 is a security release that provides two security fixes that enhance your Adobe Commerce 2.4.3 or Magento Open Source 2.4.3 deployment. It provides fixes for vulnerabilities that have been identified in the previous release (Adobe Commerce 2.4.3 and Magento Open Source 2.4.3).

NOTE
Adobe Commerce and Magento Open Source releases may contain backward-incompatible changes (BICs). To review backward-incompatible changes, see BIC reference. Major backward-incompatible issues are described in BIC highlights. Not all releases introduce major BICs.

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. Adobe Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Apply a patch to continue offering DHL as shipping carrier Knowledge Base article for information about downloading and installing the patch.

What’s in this release?

This security patch includes:

  • Resolution of the vulnerability addressed by MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch.zip, MDVA-43443_EE_2.4.3-p1_COMPOSER_v1.patch.zip,MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch, and MDVA-43443_EE_2.4.3-p1_COMPOSER_v1.patch
  • The security enhancements described in these release notes
  • Two security bug fixes. See Adobe Security Bulletin for the latest discussion of these fixed issues.

Security enhancements

Security improvements for this release improve compliance with the latest security best practices, including:

  • Email variable usage was deprecated back in 2.3.4 as part of a security risk mitigation in favor of a more strict variable syntax. This legacy behavior has been fully removed in this release as a continuation of that security risk mitigation.

    As a result, email or newsletter templates that worked in previous versions may not work correctly after upgrading to Adobe Commerce 2.4.3-p2. Affected templates include admin overrides, themes, child themes, and templates from custom modules or third-party extensions. Your deployment may still be affected even after using the Upgrade compatibility tool to fix deprecated usages. See Migrating custom email templates for information about potential effects and guidelines for migrating affected templates.

  • OAuth access tokens and password reset tokens are now encrypted when stored in the database.

  • Validation has been strengthened to prevent the upload of non alpha-numeric file extensions.

  • Swagger is now disabled by default when Adobe Commerce is in production mode.

  • Developers can now configure the limit on the size of arrays accepted by Adobe Commerce RESTful endpoints on a per-endpoint basis. See API security.

  • Added mechanisms for limiting the size and number of resources that a user can request through a web API on a system-wide basis, and for overriding the defaults on individual modules. This resolves the issue addressed by MC-43048__set_rate_limits__2.4.3.patch. See API security.

Installation and upgrade instructions

For instructions on downloading and applying security patches (including patch 2.4.3-p2), see Quick start install.

More information?

For general information about security patches, see Introducing the New Security Patch Release.

recommendation-more-help
1d4eef6c-fef1-4e61-85eb-b58d7b9ac29f