I am using Magento 1.4.1.1 and I received a message:
"New Magento Security Patch (SUPEE-6788) – Install Immediately"
but I could not find patch SUPEE-6788 for Magento 1.4.1.1.
Is it required to install patch SUPEE-6788 on Magento 1.4.1.1?
Add a comment
|
4 Answers
First of all, these messages stand apart from whether or not you need it or you already applied it.
Second: You do need to patch your Magento CE 1.4.x.x The security issues also affect this version.
The problem is that Magento does not supply patches for these older versions as they are no longer in "official" support. You should either upgrade your Magento (highly recommended) or try to patch it yourself by opening the patch file and see what was done in there and apply the same changes manually to your Magento 1.4.1.1.
For the critical SUPEE-5344 the community came up with patches for older versions, so you could also await that.
UPDATE:
SUPEE-6788 patches are now available for Magento 1.4.x.x (including 1.4.1.1), 1.5.x.x and 1.6.x.x on the Magento download page: https://www.magentocommerce.com/download
-
1There is probably no patch for older versions because the new whitelist tables come from an internal version update of Mage_Admin from 1.6.1.1 to 1.6.1.2 and it has been at 1.6.1.1 since CE 1.7.0.2 (EE 1.12.0.2). A module verison update to 1.6.1.2 on older installations would make future updates of Magento impossible. Now to release a patch for CE 1.4 they would need to figure out how to update the version number on older installations, without breaking future updates. Unfortunately the current patch does not check if the tables already exist, so this is going to be tough. Oct 28, 2015 at 12:53
-
@fschmengler, you have a very good point there. I do think that people still running 1.4 or 1.5 will never ever upgrade and are more likely stubbornly patching and fixing things on their outdated installs for eternity getting further and further away from the possibility to upgrade... I've emphasised "highly recommended" ;)– 7ochemOct 28, 2015 at 13:08
The mail send from the official mailing list and the official news announcement regarding SUPEE-6788 states that there will be a patch for 1.4 and all later versions:
DOWNLOADING THE SECURITY PATCH
Patches are available for Magento Enterprise Edition 1.7 and later releases and Magento Community Edition 1.4 and later releases. Before implementing this new security patch (SUPEE-6788), you must first implement all previous security patches. This will ensure that the patch works properly.
As of today, there is no patch to download for version 1.4 nevertheless. In the past it took up to a week, before the patches for the older versions were released.
Also for the preceding patch SUPEE-6285, the same mailing list was used to announce availability of a patch for 1.4, while this statement was later revoked. You can read more about it here (finally a patch was released in that situation).
So even while the patch was officially announced we can't be sure if and when it will arrive. At this point in time it is at least safe to assume that 1.4 is affected by these security vulnerabilities.
Yes, Magento 1.4 also needs to be patched.
The patch will be released soon according to this forum thread:
Hope this helps!
The patch has now been released for Magento 1.4.0.0+ and can be downloaded from the Community Edition Downloads page under the "Magento Community Edition Patches" section.
