Adobe Commerce 2.4.4 Security Patch Release Notes

These security patch release notes capture updates to enhance the security of your Adobe Commerce deployment. Information includes but is not limited to the following:

Learn more about security patch releases:

2.4.4-p8

The Adobe Commerce 2.4.4-p8 security release provides security bug fixes for your Adobe Commerce 2.4.4 deployment. These updates fix vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-18.

2.4.4-p7

The Adobe Commerce 2.4.4-p7 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements that improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-03.

Security highlights

This release introduces two significant security enhancements:

2.4.4-p6

The Adobe Commerce 2.4.4-p6 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements that improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-50.

This release also includes security enhancements that improve compliance with the latest security best practices.

Security highlight

This release introduces a new full page cache configuration setting that helps to mitigate the risks associated with the {BASE-URL}/page_cache/block/esi HTTP endpoint. This endpoint supports unrestricted, dynamically loaded content fragments from Commerce layout handles and block structures. The new Handles Param configuration setting sets the value of this endpoint’s handles parameter, which determines the maximum allowed number of handles per API. The default value of this property is 100. Merchants can change this value from the Admin (Stores > Settings: Configuration > System > Full Page Cache > Handles Param).

Known issue

Issue: Adobe Commerce displays a wrong checksum error during download by Composer from repo.magento.com, and package download is interrupted. This issue can occur during download of release packages that were made available during prerelease and is caused by a repackaging of the magento/module-page-cache package.

Workaround: Merchants who see this error during download can take these steps:

If the checksum problem persists, remove the composer.lock file before re-running the bin/magento composer update command to update every package.

2.4.4-p5

The Adobe Commerce 2.4.4-p5 security release provides security bug fixes for vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-42.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the jQuery UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

2.4.4-p4

The Adobe Commerce 2.4.4-p4 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements and platform upgrades to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-35.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the jQuery UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

Security highlight

The default behavior of the isEmailAvailable GraphQL query and (V1/customers/isEmailAvailable) REST endpoint has changed. By default, the API now always returns true. Merchants can enable the original behavior, which is to return true if the email does not exist in the database and false if it exists.

Platform upgrades

Platform upgrades for this release improve compliance with the latest security best practices.

2.4.4-p3

The Adobe Commerce 2.4.4-p3 security release provides security bug fixes for vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-17.

2.4.4-p2

The Adobe Commerce 2.4.4-p2 security release provides fixes for vulnerabilities that have been identified in previous releases. One fix includes the creation of a new configuration setting. The Require email confirmation if email has been changed configuration setting lets administrators require email confirmation when an admin user changes their email address.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB22-48.

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. Adobe Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Apply a patch to continue offering DHL as a shipping carrier Knowledge Base article for information about downloading and installing the patch.

2.4.4-p1

The Adobe Commerce 2.4.4-p1 security release provides fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin.t

Apply AC-3022.patch to continue offering DHL as a shipping carrier

DHL has introduced schema version 6.2 and will deprecate schema version 6.0 in the near future. Adobe Commerce 2.4.4 and earlier versions that support the DHL integration support only version 6.0. Merchants deploying these releases should apply AC-3022.patch at their earliest convenience to continue offering DHL as a shipping carrier. See the Apply a patch to continue offering DHL as a shipping carrier Knowledge Base article for information about downloading and installing the patch.

Security highlights

Security improvements for this release improve compliance with the latest security best practices, including:

Known issues

Issue: Web API and integration tests display this error when run on the 2.4.4-p1 package: [2022-06-14T16:58:23.694Z] PHP Fatal error: Declaration of Magento\TestFramework\ErrorLog\Logger::addRecord(int $level, string $message, array $context = []): bool must be compatible with Monolog\Logger::addRecord(int $level, string $message, array $context = [], ?Monolog\DateTimeImmutable $datetime = null): bool in /var/www/html/dev/tests/integration/framework/Magento/TestFramework/ErrorLog/Logger.php on line 69. Workaround: Install the previous version of Monolog by running the require monolog/monolog:2.6.0 command.

Issue: Merchants may notice package version downgrade notices during an upgrade from Adobe Commerce 2.4.4 to Adobe Commerce 2.4.4-p1. These messages can be ignored. The discrepancy in package versions results from anomalies during package generation. No product functionality has been affected. See the Packages downgraded after upgrading from 2.4.4 to 2.4.4-p1 Knowledge Base article for a discussion of affected scenarios and workarounds.