Magento 2.4.6-p7 and 2.4.7-p2: the August 2024 security update
With APSB24-61 Adobe fixed several critical vulnerabilities in Magento 2 in August 2024. Affected versions, the matching updates and an isolated patch for Apache servers.
On 13 August 2024, Adobe published security bulletin APSB24-61. It fixes critical vulnerabilities in Magento 2 and Adobe Commerce that can lead to code execution, arbitrary file reads and privilege escalation, among others.
Affected versions and updates
- 2.4.7-p1 and earlier → update to 2.4.7-p2
- 2.4.6-p6 and earlier → update to 2.4.6-p7
- 2.4.5-p8 and earlier → update to 2.4.5-p9
- 2.4.4-p9 and earlier → update to 2.4.4-p10
2.4.6-p7 still runs on PHP 8.1 and 8.2, so shops staying on 2.4.6 can apply it without changing PHP.
Special case Apache: CVE-2024-39397
One of the vulnerabilities (CVE-2024-39397) allows uploading arbitrary files and only affects shops running on the Apache web server. Adobe also released an isolated patch for versions 2.4.4 to 2.4.7. If you run Apache and cannot apply the full update right away, this patch is the minimum.
How urgent is it?
Adobe was not aware of any attacks when the bulletin was published. But CosmicSting showed that only days may pass between a patch and the first attacks. In the shops I look after, I apply updates like this within a few days, after testing on staging.
If you need help with the update, write to me.
Source: Adobe APSB24-61.