Contents
What are the security enhancements in Magento 2?
Magento Commerce and Open Source 2.3.3, 2.3.2-p1 and 2.2.10 contain tens of security enhancements that help close Remote Code Execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities. Merchants who have not previously downloaded a Magento 2 release should go straight to Magento Commerce or Open Source 2.3.3.
What’s the difference between Magento 2.2 and 2.3?
Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 An authenticated user can leverage plugin functionality that is related to email templates to manipulate the interceptor class in a way that allows a maliocus user to execute arbitrary code.
Which is the latest version of Magento Commerce?
Merchants who have not previously downloaded a Magento 2 release should go straight to Magento Commerce or Open Source 2.3.3. Please refer to Security Best Practices for additional information how to secure your site. The Magento 2.2.10 software release marks the final supported software release for Magento version 2.1.x.
Is there a remote code execution vulnerability in Magento?
PRODSECBUG-2446: Remote code execution through custom layout update in the create product functionality (RCE) – CVE-2019-8122 A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3.
Is there a vulnerability in Magento store locator?
A critical vulnerability exists in the Magestore Store Locator extension version 1.0.2 (and earlier versions) that could result in unauthorized access to sensitive information. Magento urges customers running this extension to immediately disable this extension or block requests.
What can an unauthenticated user do in Magento?
An unauthenticated user in Magento 2.x, or an authenticated user in Magento 1.x, can execute SQL statements that allow arbitrary read access to the underlying database. Note: this issue was addressed in previous patches 2.2.8 and 2.3.1 and also in separately released patches PRODSECBUG-2198.
How can I execute arbitrary code in Magento?
An authenticated user with admin privileges can execute arbitrary code through crafted email template code when previewing the template. An authenticated user with admin privileges to create sitemaps can execute arbitrary code by crafted filenames that include php extension within the XML filename.
How to apply the Magento 2 patches in composer?
The patch has been added to you composer.json You can now run: “composer install” to apply the patch. magento@ce87c6cc1cdf /home/magento/htdocs/$ I use it on Mdoq, but it can be used anywhere.
Where do I find the patches in Magento?
In our Magento root, we have a patches/composer directory which is where we reference them and in the extras/patches section, we tell it which Magento module to patch. Ironically I found this post when looking at how this was done only to find our solution was already in place by our initial vendor.
Which is the latest version of Magento for PHP?
Patch MDVA-84 for Magento Community Edition – MDVA-84.zip, .tar.gz, and .tar.bz2, Apply this patch if you are running Magento CE 2.0.1 and your Magento server runs 7.0.1 or PHP 7.0.2. It adds support for PHP 7.0.2 to the updater application. See technical bulletin Issues upgrading to 2.0.1 (Jan. 28, 2016) for more information.
Is it possible to disable symlinks in Magento 1.x?
This will not affect your current symlink settings, if you manually enabled symlinks prior to 1.9.3.2 they will stay enabled, although you cannot see the setting anymore in admin. Users using modman to manage Magento 1.x modules should ensure that they do not disable symlinks as this will disable the modman modules.