No APSB22-48 patches for Magento 2.3

Question

We are still running Magento community version 2.3.4x. We are upgrading since 4 months to current version, there were many plug-ins not compatible and so on. Now we are about 2-3 weeks before we can fully switch.

On 11. of Oct. Adobe released:

Security update available for Adobe Commerce | APSB22-48

https://helpx.adobe.com/security/products/magento/apsb22-48.html

But our version of out of service since one month.

So we can not switch now, and there is also no patch.

Adobe Commerce 2.4.5 and earlier versions  

What can we do until then?

I know this is not an adequate question here, but since It will probably affect 60% of all Shop worldwide, it's necessary to ask this here.

Answer 1

Magento 2.3 is end of support, so there are no APSB22-48 patches for Magento 2.3.

Adobe will create a hotfix for all affected [supported] versions of the CVSS 10 from their last release. The hotfix will be released end of today or the begin next week. I will share the link when it is available.

Currently, supported versions are 2.4.0 - through 2.4.5-p1.

So you can do your upgrade as normal and wait for the hotfix.

UPDATE: The hotfix was released today - October 18, 2022:

Adobe Commerce on cloud infrastructure and on-premises, and Magento Open Source:

2.4.5
2.4.4, 2.4.4-p1
2.4.3-p2, 2.4.3-p3
2.4.3-p1 and below 2.4.3-p1 are not affected if all applicable security hotfixes are applied.

https://experienceleague.adobe.com/docs/commerce-knowledge-base/kb/troubleshooting/known-issues-patches-attached/adobe-commerce-2.4.0-2.4.5-security-hotfix-for-cve-2022-35698.html

Answer 2

https://github.com/EmicoEcommerce/Magento-APSB22-48-Security-Patches

This repository contains Magento 2 Patch Files for the recently found security issues on 12-10-2022. The patch files aim to fix the CVE-2022-35698 and CVE-2022-35689 vulnerabilities.