Release notes for Adobe Commerce 2.4.6 security patches

These security patch release notes capture updates to enhance the security of your Adobe Commerce deployment. Information includes, but is not limited to, the following:

  • Security bug fixes
  • Security highlights that provide more detail about enhancements and updates included in the security patch
  • Known issues
  • Instructions to apply additional patches if required
  • Information about any hot fixes included in the release

Learn more about security patch releases:

Adobe Commerce 2.4.6-p6

The Adobe Commerce 2.4.6-p6 security release provides security bug fixes for vulnerabilities that have been identified in previous releases of 2.4.6.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-40.

Security hightlight

For compatibility with Commerce version 2.4.6-p6, merchants that have the Adobe Commerce B2B extension must upgrade to B2B version 1.4.2-p1.

Additional security enhancements

  • Added Subresource Integrity (SRI) support to comply with PCI 4.0 requirements for verification of script integrity on payment pages. Subresource Integrity (SRI) support provides integrity hashes for all JavaScript assets residing in the local filesystem. The default SRI feature is implemented only on the payment pages for the Admin and storefront areas. However, merchants can extend the default configuration to other pages. See Subresource Integrity in the Commerce PHP Developer Guide.

  • Changes to Content Security Policy (CSP)—Configuration updates and enhancements to Adobe Commerce Content Security Policies (CSPs) to comply with PCI 4.0 requirements. For details, see Content Security Policies in the Commerce PHP Developer Guide.

    • The default CSP configuration for payment pages for Commerce Admin and storefront areas is now restrict mode. For all other pages, the default configuration is report-only mode. In releases prior to 2.4.7, CSP was configured in report-only mode for all pages.

    • Added a nonce provider to allow execution of inline scripts in a CSP. The nonce provider facilitates the generation of unique nonce strings for each request. The strings are then attached to the CSP header.

    • Added options to configure custom URIs to report CSP violations for the Create Order page in the Admin and the Checkout page in the storefront. You can add the configuration from the Admin or by adding the URI to the config.xml file.

      note note
      NOTE
      Updating the CSP configuration to restrict mode might block existing inline scripts on payment pages in the Admin and storefront, which causes the following browser error when a page loads: Refused to execute inline script because it violates the following Content Security Policy directive: "script-src. Fix these errors by updating the whitelist configuration to allow required scripts. See Troubleshooting in the Commerce PHP Developer Guide.

Adobe Commerce 2.4.6-p5

The Adobe Commerce 2.4.6-p5 security release provides security bug fixes for vulnerabilities that have been identified in previous releases of 2.4.6.

For the latest information about these fixes, see Adobe Security Bulletin APSB24-18.

Adobe Commerce 2.4.6-p4

The Adobe Commerce 2.4.6-p4 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements that improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB24-03.

Security highlights

This release introduces two significant security enhancements:

  • Changes to the behavior of non-generated cache keys:

    • Non-generated cache keys for blocks now include prefixes that differ from prefixes for keys that are generated automatically. (Non-generated cache keys are keys that are set through template directive syntax or the setCacheKey or setData methods.)
    • Non-generated cache keys for blocks now must contain only letters, digits, hyphens (-), and underscore characters (_).
  • Limitations on the number of auto-generated coupon codes. Commerce now limits the number of coupon codes that are automatically generated. The default maximum is 250,000. Merchants can use the new Code Quantity Limit configuration option (Stores > Settings:Configuration > Customers > Promotions) to control this new limit.

Adobe Commerce 2.4.6-p3

The Adobe Commerce 2.4.6-p3 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements to improve compliance with the latest security best practices.

For the latest information about the security fixes, see Adobe Security Bulletin APSB23-50.

Security highlights

This release introduces a new full page cache configuration setting that helps to mitigate the risks associated with the {BASE-URL}/page_cache/block/esi HTTP endpoint. This endpoint supports unrestricted, dynamically loaded content fragments from Commerce layout handles and block structures. The new Handles Param configuration setting sets the value of this endpoint’s handles parameter, which determines the maximum allowed number of handles per API. The default value of this property is 100. Merchants can change this value from the Admin (Stores > Settings:Configuration > System > Full Page Cache > Handles Param.

Hotfixes included in this release

Adobe Commerce 2.4.6-p3 includes resolution of the performance degradation fixed by patch ACSD-51892. Merchants are not affected by the issue addressed by this patch, which is described in the ACSD-51892: Performance issue where config files load multiple times Knowledge Base article.

Known issue

Issue: Adobe Commerce displays a wrong checksum error during download by Composer from repo.magento.com, and package download is interrupted. This issue can occur during download of release packages made available during the prerelease period and is caused by a repackaging of the magento/module-page-cache package.

Workaround: Merchants who see this error during download can take these steps:

  1. Delete the /vendor directory inside the project, if one exists.
  2. Run the bin/magento composer update magento/module-page-cache command. This command updates only the page cache package.

If the checksum problem persists, remove the composer.lock file before re-running the bin/magento composer update command to update every package.

2.4.6-p2

The Adobe Commerce 2.4.6-p2 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also provides security enhancements to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-42.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the jQuery UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

Security highlight

The value of fastcgi_pass in the nginx.sample file has been returned to it’s previous (pre-2.4.6-p1) value of fastcgi_backend. This value was inadvertently changed to php-fpm:9000 in Adobe Commerce 2.4.6-p1.

Hotfixes included in this release

Adobe Commerce 2.4.6-p2 includes resolution of the performance degradation that was addressed by patch ACSD-51892. Merchants are not affected by the issue addressed by this patch, which is described in the ACSD-51892: Performance issue where config files load multiple times Knowledge Base article.

Adobe Commerce 2.4.6-p1

The Adobe Commerce 2.4.6-p1 security release provides security bug fixes for vulnerabilities that have been identified in previous releases. This release also includes security enhancements and platform upgrades to improve compliance with the latest security best practices.

For the latest information about the security bug fixes, see Adobe Security Bulletin APSB23-35.

Apply patch to resolve security vulnerability CVE-2022-31160 in jQuery-UI library

jQuery-UI library version 1.13.1 has a known security vulnerability (CVE-2022-31160) that affects multiple versions of Adobe Commerce and Magento Open Source. This library is a dependency of Adobe Commerce and Magento Open Source 2.4.4, 2.4.5, and 2.4.6. Merchants running affected deployments should apply the patch specified in the Query UI security vulnerability CVE-2022-31160 fix for 2.4.4, 2.4.5, and 2.4.6 releases Knowledge Base article.

Security highlight

The default behavior of the isEmailAvailable GraphQL query and (V1/customers/isEmailAvailable) REST endpoint has changed. By default, the API now always returns true. Merchants can enable the original behavior, which is to return true if the email does not exist in the database and false if it exists.

Platform upgrades

Platform upgrades for this release improve compliance with the latest security best practices.

  • Varnish cache 7.3 support. This release is compatible with the latest version of Varnish Cache 7.3. Compatibility remains with the 6.0.x and 7.2.x versions, but Adobe recommended using Adobe Commerce 2.4.6-p1 only with Varnish Cache version 7.3 or version 6.0 LTS.

  • RabbitMQ 3.11 support. This release is compatible with the latest version of RabbitMQ 3.11. Compatibility remains with RabbitMQ 3.9, which is supported through August 2023, but Adobe recommended using Adobe Commerce 2.4.6-p1 only with RabbitMQ 3.11.

  • JavaScript libraries. Outdated JavaScript libraries have been upgraded to the latest minor or patch versions, including moment.js library (v2.29.4), jQuery UI library (v1.13.2), and jQuery validation plugin library (v1.19.5).

Known issues

  • The nginx.sample file was inadvertently updated with a change that modifies the value of fastcgi_pass from fastcgi_backend to php-fpm:9000. This change can be safely reverted or ignored.

  • Missing dependencies for the B2B security package cause the following installation error when installing or upgrading the B2B extension to 1.4.0.

    code language-terminal
    Your requirements could not be resolved to an installable set of packages.
    
      Problem 1
        - Root composer.json requires magento/extension-b2b 1.4.0 -> satisfiable by magento/extension-b2b[1.4.0].
        - magento/extension-b2b 1.4.0 requires magento/security-package-b2b 1.0.4-beta1 -> found magento/security-package-b2b[1.0.4-beta1] but it does not match your minimum-stability.
    
    Installation failed, reverting ./composer.json and ./composer.lock to their original content.
    

    This issue can be resolved by adding manual dependencies for the B2B security package with a stability tag. For details, see the B2B release notes.

recommendation-more-help
1d4eef6c-fef1-4e61-85eb-b58d7b9ac29f