Magento vulnerability in 2.4 and 2.3

Question

Anyone knows what's going on with Magento. There are a lot of websites getting compromised recently and it doesn't matter which version you are.

Which version is safe for now? and are there any patch versions coming for 2.3 and 2.4?

Answer 1

Adobe Commerce 2.4.5-p1 is a security release that provides five security fixes that enhance your Adobe Commerce 2.4.5 or Magento Open Source 2.4.5 deployment. It provides fixes for vulnerabilities that have been identified in the previous release (Adobe Commerce 2.4.5 and Magento Open Source 2.4.5).

https://devdocs.magento.com/guides/v2.4/release-notes/2-4-5-p1.html

Answer 2

Versions are safe for now (both Magento Open Source and Adobe Commerce): 2.4.5-p1 and 2.4.4-p2.

• Adobe Commerce 2.4.5-p1 is a security release that provides five security fixes that enhance your Adobe Commerce 2.4.5 or Magento Open Source 2.4.5 deployment. It provides fixes for vulnerabilities that have been identified in the previous release (Adobe Commerce 2.4.5 and Magento Open Source 2.4.5). Release note: https://devdocs.magento.com/guides/v2.4/release-notes/2-4-5-p1.html

• Adobe Commerce 2.4.4-p2 is a security release that provides five security fixes that enhance your Adobe Commerce 2.4.4 or Magento Open Source 2.4.4 deployment. It provides fixes for vulnerabilities that have been identified in the previous release (Adobe Commerce 2.4.4 and Magento Open Source 2.4.4). Release note: https://devdocs.magento.com/guides/v2.4/release-notes/2-4-4-p2.html

For the security bulletin APSB22-48 which was recently released and also included in 2.4.5-p1 and 2.4.4-p2 on October 11, 2022, Adobe will be releasing hotfixes for 2.4.3-p2, 2.4.3-p3, 2.4.4, 2.4.4-p1, and 2.4.5 next week.

There is no patch for 2.3 because 2.3 reached the end of support on September 8, 2022.