DocumentationCommerceRelease information

Release Notes for Adobe Commerce 2.4.5 Security Patches

Last update: Thu May 16 2024 00:00:00 GMT+0000 (Coordinated Universal Time)

CREATED FOR:

  • Experienced
  • Admin
  • Developer

These security patch release notes capture updates to enhance the security of your Adobe Commerce deployment. Information includes but is not limited to the following:

  • Security bug fixes
  • Security highlights that provide more detail about enhancements and updates included in the security patch
  • Known issues
  • Instructions to apply additional patches if required
  • Information about any hot fixes included in the release

Learn more about security patch releases:

Adobe Commerce 2.4.5-p7

The Adobe Commerce 2.4.5-p7 security release provides security bug fixes for vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-18.

Adobe Commerce 2.4.5-p6

The Adobe Commerce 2.4.5-p6 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-03.

Security highlights

This release introduces two significant security enhancements:

  • Changes to the behavior of non-generated cache keys:

    • Non-generated cache keys for blocks now include prefixes that differ from prefixes for keys that are generated automatically. (Non-generated cache keys are keys that are set through template directive syntax or the setCacheKey or setData methods.)
    • Non-generated cache keys for blocks now must contain only letters, digits, hyphens (-), and underscore characters (_).

  • Limitations on the number of auto-generated coupon codes. Commerce now limits the number of coupon codes that are automatically generated. The default maximum is 250,000. Merchants can use the new Code Quantity Limit configuration option (Stores > Settings:Configuration > Customers > Promotions) to control this new limit.

Adobe Commerce 2.4.5-p5

The Adobe Commerce 2.4.5-p5 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-50.

Security highlight

This release introduces a new full page cache configuration setting that helps to mitigate the risks associated with the {BASE-URL}/page_cache/block/esi HTTP endpoint. This endpoint supports unrestricted, dynamically loaded content fragments from Commerce layout handles and block structures. The new Handles Param configuration setting sets the value of this endpoint’s handles parameter, which determines the maximum allowed number of handles per API. The default value of this property is 100. Merchants can change this value from the Admin (Stores > Settings:Configuration > System > Full Page Cache > Handles Param).

Known issue

Issue: Adobe Commerce displays a wrong checksum error during download by Composer from repo.magento.com, and package download is interrupted. This issue can occur during download of release packages that were made available during prerelease and is caused by a repackaging of the magento/module-page-cache package.

Workaround: Merchants who see this error during download can take these steps:

  1. Delete the /vendor directory inside the project, if one exists.
  2. Run the bin/magento composer update magento/module-page-cache command. This command updates only the page cache package.

If the checksum problem persists, remove the composer.lock file before re-running the bin/magento composer update command to update every package.

Adobe Commerce 2.4.5-p4

The Adobe Commerce 2.4.5-p4 security release provides security bug fixes for vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-42.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the jQuery UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

Adobe Commerce 2.4.5-p3

The Adobe Commerce 2.4.5-p3 security release provides security fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements that improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the Query UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

Security highlight

The default behavior of the isEmailAvailable GraphQL query and (V1/customers/isEmailAvailable) REST endpoint has changed. By default, the API now always returns true. Merchants can enable the original behavior, which is to return true if the email does not exist in the database and false if it exists.

Platform upgrades

Platform upgrades for this release improve compliance with the latest security best practices.

  • Varnish cache 7.3 support. This release is compatible with the latest version of Varnish Cache 7.3. Compatibility remains with the 6.0.x and 7.2.x versions, but we recommended using Adobe Commerce 2.4.5-p3 only with Varnish Cache version 7.3 or version 6.0 LTS.

  • RabbitMQ 3.11 support. This release is compatible with the latest version of RabbitMQ 3.11. Compatibility remains with RabbitMQ 3.9, which is supported through August 2023, but we recommended using Adobe Commerce 2.4.5-p3 only with RabbitMQ 3.11.

  • JavaScript libraries. Outdated JavaScript libraries have been upgraded to the latest minor or patch versions, including moment.js library (v2.29.4), jQuery UI library (v1.13.2), and jQuery validation plugin library (v1.19.5).

Adobe Commerce 2.4.5-p2 release notes

The Adobe Commerce 2.4.5-p2 security release provides three security fixes for vulnerabilities that have been identified in previous releases.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-17.

Adobe Commerce 2.4.5-p1

The Adobe Commerce 2.4.5-p1 security release provides security bug fixes for vulnerabilities that have been identified in the previous release (Adobe Commerce 2.4.5 and Magento Open Source 2.4.5).

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB22-48.

One of the security bug fixes included the creation of a new configuration setting. The Require email confirmation if email has been changed configuration setting lets administrators require email confirmation when an Admin user changes their email address.

recommendation-more-help
1d4eef6c-fef1-4e61-85eb-b58d7b9ac29f