2

We are still running Magento community version 2.3.4x. We are upgrading since 4 months to current version, there were many plug-ins not compatible and so on. Now we are about 2-3 weeks before we can fully switch.

On 11. of Oct. Adobe released:

Security update available for Adobe Commerce | APSB22-48

https://helpx.adobe.com/security/products/magento/apsb22-48.html

But our version of out of service since one month.

So we can not switch now, and there is also no patch.

Adobe Commerce 2.4.5 and earlier versions  

What can we do until then?

I know this is not an adequate question here, but since It will probably affect 60% of all Shop worldwide, it's necessary to ask this here.

1
  • I've added an update in my comment, if you think that is what you expected, please marks it as an accept answer to help other who come later know this question is resolved.
    – Tu Van
    Commented Oct 18, 2022 at 8:06

2 Answers 2

1

Magento 2.3 is end of support, so there are no APSB22-48 patches for Magento 2.3.

Adobe will create a hotfix for all affected [supported] versions of the CVSS 10 from their last release. The hotfix will be released end of today or the begin next week. I will share the link when it is available.

Currently, supported versions are 2.4.0 - through 2.4.5-p1.

So you can do your upgrade as normal and wait for the hotfix.

UPDATE: The hotfix was released today - October 18, 2022:

Adobe Commerce on cloud infrastructure and on-premises, and Magento Open Source:

2.4.5
2.4.4, 2.4.4-p1
2.4.3-p2, 2.4.3-p3
2.4.3-p1 and below 2.4.3-p1 are not affected if all applicable security hotfixes are applied.

https://experienceleague.adobe.com/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/adobe-commerce-2.4.0-2.4.5-security-hotfix-for-cve-2022-35698.html

0
0

https://github.com/EmicoEcommerce/Magento-APSB22-48-Security-Patches

This repository contains Magento 2 Patch Files for the recently found security issues on 12-10-2022. The patch files aim to fix the CVE-2022-35698 and CVE-2022-35689 vulnerabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.