Release notes for Adobe Commerce 2.4.6 security patches
These security patch release notes capture updates to enhance the security of your Adobe Commerce deployment. Information includes, but is not limited to, the following:
- Security bug fixes
- Security highlights that provide more detail about enhancements and updates included in the security patch
- Known issues
- Instructions to apply additional patches if required
- Information about any hot fixes included in the release
Learn more about security patch releases:
- Adobe Commerce Security Patch Releases overview
- Instructions for downloading and applying security patch releases are available in the Upgrade Guide
2.4.6-p8
The Adobe Commerce 2.4.6-p8 security release provides security bug fixes for vulnerabilities identified in previous releases of 2.4.6.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-73.
Highlights
This release includes the following highlights:
-
TinyMCE upgrade—The WYSIWYG editor in the Admin now uses the latest version of the TinyMCE dependency (7.3).
-
TinyMCE 7.3 offers an enhanced user experience, better collaboration, and increased efficiency. TinyMCE 5 has been removed in the 2.4.8 release line.
-
Since there was a security vulnerability (CVE-2024-38357) reported in TinyMCE 5.10, the dependency was also upgraded for all currently supported release lines and included in all October 2024 security patches:
- 2.4.7-p3
- 2.4.6-p8
- 2.4.5-p10
- 2.4.4-p11
-
-
Require.js upgrade—Adobe Commerce now uses the latest version of Require.js (2.3.7).
-
Since there was a security vulnerability (CVE-2024-38999) reported in Require.js 2.3.6, the dependency was also upgraded for all currently supported release lines and included in all October 2024 security patches:
- 2.4.7-p3
- 2.4.6-p8
- 2.4.5-p10
- 2.4.4-p11
-
Hotfixes included in this release
This release includes a hotfix to resolve an issue with the Braintree payment gateway.
The system now includes the necessary fields to fulfill the 3DS VISA mandate requirements when using Braintree as a payment gateway. This ensures that all transactions comply with the latest security standards set by VISA. Previously, these additional fields were not included in the payment information sent, which could have led to non-compliance with the new VISA requirements.
2.4.6-p7
The Adobe Commerce 2.4.6-p7 security release provides security bug fixes for vulnerabilities identified in previous releases of 2.4.6.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-61.
Highlights
This release includes the following highlights:
-
Rate limiting for one-time passwords—The following new system configuration options are now available to enable rate limiting on two-factor authentication (2FA) one-time password (OTP) validation:
- Retry attempt limit for Two-Factor Authentication
- Two-Factor Authentication lockout time (seconds)
Adobe advises setting a threshold for 2FA OTP validation to limit the number of retry attempts to mitigate brute-force attacks. See Security > 2FA in the Configuration Reference Guide for more information.
-
Encryption key rotation—A new CLI command is now available for changing your encryption key. See the Troubleshooting Encryption Key Rotation: CVE-2024-34102 Knowledge Base article for details.
-
Fix for CVE-2020-27511—Resolves a Prototype.js security vulnerability.
-
Fix for CVE-2024-39397—Resolves a remote code execution security vulnerability. This vulnerability affects merchants using the Apache web server for on-premises or self-hosted deployments. This fix is also available as an isolated patch. See the Security update available for Adobe Commerce - APSB24-61 Knowledge Base article for details.
Hotfixes included in this release
This release includes the following hotfixes:
-
Hotfix to resolve a JavaScript error that prevented Google Maps from rendering properly in the PageBuilder editor. See the Revised patches for Google Maps access loss on all Adobe Commerce versions Knowledge Base article for details.
-
Hotfix to resolve a JSON web token (JWT) validation issue related to CVE-2024-34102. See the Security update available for Adobe Commerce-APSB24-40 Knowledge Base article for details.
2.4.6-p6
The Adobe Commerce 2.4.6-p6 security release provides security bug fixes for vulnerabilities that have been identified in previous releases of 2.4.6.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-40.
For compatibility with Commerce version 2.4.6-p6, merchants that have the Adobe Commerce B2B extension must upgrade to B2B version 1.4.2-p1.
Apply hotfix for CVE-2024-34102
For customers who have not applied security patch released on June 11, 2024 or the isolated patch released on June 28, 2024:
Option 1:
Option 2:
-
Apply the isolated patch.
-
Rotate encryption keys.
For customers who have already applied a security patch released on June 11, 2024 or the isolated patch released on June 28, 2024:
For customers who have already 1) applied a security patch released on June 11, 2024 or, 2) the isolated patch released on June 28, 2024, and 3) rotated their encryption keys:
- Apply the hotfix released on July 17, 2024.
For compatibility with Commerce version 2.4.6-p6, merchants that have the Adobe Commerce B2B extension must upgrade to B2B version 1.4.2-p1.
Highlights
-
Added Subresource Integrity (SRI) support to comply with PCI 4.0 requirements for verification of script integrity on payment pages. Subresource Integrity (SRI) support provides integrity hashes for all JavaScript assets residing in the local filesystem. The default SRI feature is implemented only on the payment pages for the Admin and storefront areas. However, merchants can extend the default configuration to other pages. See Subresource Integrity in the Commerce PHP Developer Guide.
-
Changes to Content Security Policy (CSP)—Configuration updates and enhancements to Adobe Commerce Content Security Policies (CSPs) to comply with PCI 4.0 requirements. For details, see Content Security Policies in the Commerce PHP Developer Guide.
-
The default CSP configuration for payment pages for Commerce Admin and storefront areas is now
restrict
mode. For all other pages, the default configuration isreport-only
mode. In releases prior to 2.4.7, CSP was configured inreport-only
mode for all pages. -
Added a nonce provider to allow execution of inline scripts in a CSP. The nonce provider facilitates the generation of unique nonce strings for each request. The strings are then attached to the CSP header.
-
Added options to configure custom URIs to report CSP violations for the Create Order page in the Admin and the Checkout page in the storefront. You can add the configuration from the Admin or by adding the URI to the
config.xml
file.note note NOTE Updating the CSP configuration to restrict
mode might block existing inline scripts on payment pages in the Admin and storefront, which causes the following browser error when a page loads:Refused to execute inline script because it violates the following Content Security Policy directive: "script-src
. Fix these errors by updating the whitelist configuration to allow required scripts. See Troubleshooting in the Commerce PHP Developer Guide.
-
2.4.6-p5
The Adobe Commerce 2.4.6-p5 security release provides security bug fixes for vulnerabilities that have been identified in previous releases of 2.4.6.
For the latest information about these fixes, see Adobe Security Bulletin APSB24-18.
2.4.6-p4
The Adobe Commerce 2.4.6-p4 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements that improve compliance with the latest security best practices.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-03.
Highlights
This release introduces two significant security enhancements:
-
Changes to the behavior of non-generated cache keys:
- Non-generated cache keys for blocks now include prefixes that differ from prefixes for keys that are generated automatically. (Non-generated cache keys are keys that are set through template directive syntax or the
setCacheKey
orsetData
methods.) - Non-generated cache keys for blocks now must contain only letters, digits, hyphens (-), and underscore characters (_).
- Non-generated cache keys for blocks now include prefixes that differ from prefixes for keys that are generated automatically. (Non-generated cache keys are keys that are set through template directive syntax or the
-
Limitations on the number of auto-generated coupon codes. Commerce now limits the number of coupon codes that are automatically generated. The default maximum is 250,000. Merchants can use the new Code Quantity Limit configuration option (Stores > Settings:Configuration > Customers > Promotions) to control this new limit.
2.4.6-p3
The Adobe Commerce 2.4.6-p3 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements to improve compliance with the latest security best practices.
For the latest information about the security fixes, see Adobe Security Bulletin APSB23-50.
Highlights
This release introduces a new full page cache configuration setting that helps to mitigate the risks associated with the {BASE-URL}/page_cache/block/esi HTTP
endpoint. This endpoint supports unrestricted, dynamically loaded content fragments from Commerce layout handles and block structures. The new Handles Param configuration setting sets the value of this endpoint’s handles
parameter, which determines the maximum allowed number of handles per API. The default value of this property is 100. Merchants can change this value from the Admin (Stores > Settings:Configuration > System > Full Page Cache > Handles Param.
Hotfixes included in this release
Adobe Commerce 2.4.6-p3 includes resolution of the performance degradation fixed by patch ACSD-51892. Merchants are not affected by the issue addressed by this patch, which is described in the ACSD-51892: Performance issue where config files load multiple times Knowledge Base article.
Known issues
Issue: Adobe Commerce displays a wrong checksum
error during download by Composer from repo.magento.com
, and package download is interrupted. This issue can occur during download of release packages made available during the prerelease period and is caused by a repackaging of the magento/module-page-cache
package.
Workaround: Merchants who see this error during download can take these steps:
- Delete the
/vendor
directory inside the project, if one exists. - Run the
bin/magento composer update magento/module-page-cache
command. This command updates only thepage cache
package.
If the checksum problem persists, remove the composer.lock
file before re-running the bin/magento composer update
command to update every package.
2.4.6-p2
The Adobe Commerce 2.4.6-p2 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also provides security enhancements to improve compliance with the latest security best practices.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-42.
Apply hotfix for CVE-2022-31160
jQuery-UI
library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the jQuery UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.
Highlights
The value of fastcgi_pass
in the nginx.sample
file has been returned to it’s previous (pre-2.4.6-p1) value of fastcgi_backend
. This value was inadvertently changed to php-fpm:9000
in Adobe Commerce 2.4.6-p1.
Hotfixes included in this release
Adobe Commerce 2.4.6-p2 includes resolution of the performance degradation that was addressed by patch ACSD-51892. Merchants are not affected by the issue addressed by this patch, which is described in the ACSD-51892: Performance issue where config files load multiple times Knowledge Base article.
2.4.6-p1
The Adobe Commerce 2.4.6-p1 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements and platform upgrades to improve compliance with the latest security best practices.
For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-35.
Apply hotfix for CVE-2022-31160
jQuery-UI
library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the Query UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.
Highlight
The default behavior of the isEmailAvailable
GraphQL query and (V1/customers/isEmailAvailable
) REST endpoint has changed. By default, the API now always returns true
. Merchants can enable the original behavior, which is to return true
if the email does not exist in the database and false
if it exists.
Platform upgrades
Platform upgrades for this release improve compliance with the latest security best practices.
-
Varnish cache 7.3 support. This release is compatible with the latest version of Varnish Cache 7.3. Compatibility remains with the 6.0.x and 7.2.x versions, but Adobe recommended using Adobe Commerce 2.4.6-p1 only with Varnish Cache version 7.3 or version 6.0 LTS.
-
RabbitMQ 3.11 support. This release is compatible with the latest version of RabbitMQ 3.11. Compatibility remains with RabbitMQ 3.9, which is supported through August 2023, but Adobe recommended using Adobe Commerce 2.4.6-p1 only with RabbitMQ 3.11.
-
JavaScript libraries. Outdated JavaScript libraries have been upgraded to the latest minor or patch versions, including
moment.js
library (v2.29.4),jQuery UI
library (v1.13.2), andjQuery
validation plugin library (v1.19.5).
Known issues
-
The
nginx.sample
file was inadvertently updated with a change that modifies the value offastcgi_pass
fromfastcgi_backend
tophp-fpm:9000
. This change can be safely reverted or ignored. -
Missing dependencies for the B2B security package cause the following installation error when installing or upgrading the B2B extension to 1.4.0.
code language-none Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires magento/extension-b2b 1.4.0 -> satisfiable by magento/extension-b2b[1.4.0]. - magento/extension-b2b 1.4.0 requires magento/security-package-b2b 1.0.4-beta1 -> found magento/security-package-b2b[1.0.4-beta1] but it does not match your minimum-stability. Installation failed, reverting ./composer.json and ./composer.lock to their original content.
This issue can be resolved by adding manual dependencies for the B2B security package with a stability tag. For details, see the B2B release notes.