Skip to content

Commit 5c5c131

Browse files
pawan-adobe-securitypawan-adobe-security
committed
MAGECLOUD-12969: security fix patch
1 parent d92b1c7 commit 5c5c131

5 files changed

+174
-1
lines changed

‎patches.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,10 @@
282282
">=2.4.4 <2.4.7": "MCLOUD-11514__enhanced_layout_cache_efficiency__2.4.6-p3.patch"
283283
},
284284
"Patch for CVE-2024-34102 - CosmicSting": {
285-
">=2.4.4 <=2.4.8-beta1": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting_2.4.7.patch"
285+
">=2.4.7 <2.4.8": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.7.patch",
286+
">=2.4.6 <2.4.7": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.6.patch",
287+
">=2.4.5 <2.4.6": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.5.patch",
288+
">=2.4.4 <2.4.5": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.4.patch"
286289
}
287290
},
288291
"magento/module-paypal": {

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.4.patch

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index 908a4e70140..cc019845b58 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -153,6 +153,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
* @return \Magento\Framework\Reflection\NameFinder
25+
*
26+
* @deprecated 100.1.0
27+
+ * @see nothing
28+
*/
29+
private function getNameFinder()
30+
{
31+
@@ -261,6 +262,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
32+
* @throws \Exception
33+
* @throws SerializationException
34+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
35+
+ * @SuppressWarnings(PHPMD.NPathComplexity)
36+
*/
37+
protected function _createFromArray($className, $data)
38+
{
39+
@@ -268,6 +270,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
40+
// convert to string directly to avoid situations when $className is object
41+
// which implements __toString method like \ReflectionObject
42+
$className = (string) $className;
43+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
44+
+ || is_subclass_of($className, \DOMElement::class)) {
45+
+ throw new SerializationException(
46+
+ new Phrase('Invalid data type')
47+
+ );
48+
+ }
49+
$class = new ClassReflection($className);
50+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
51+
$className = substr($className, 0, -strlen('Interface'));
52+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
53+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
54+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
55+
@@ -35,6 +35,7 @@
56+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
57+
{
58+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
59+
+ $this->keys = [end($this->keys)];
60+
//Making sure keys are large enough.
61+
foreach ($this->keys as &$key) {
62+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.5.patch

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index a5e881f4be5..a60f1dd7ba1 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -153,6 +153,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
* @return \Magento\Framework\Reflection\NameFinder
25+
*
26+
* @deprecated 100.1.0
27+
+ * @see nothing
28+
*/
29+
private function getNameFinder()
30+
{
31+
@@ -261,6 +262,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
32+
* @throws \Exception
33+
* @throws SerializationException
34+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
35+
+ * @SuppressWarnings(PHPMD.NPathComplexity)
36+
*/
37+
protected function _createFromArray($className, $data)
38+
{
39+
@@ -268,6 +270,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
40+
// convert to string directly to avoid situations when $className is object
41+
// which implements __toString method like \ReflectionObject
42+
$className = (string) $className;
43+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
44+
+ || is_subclass_of($className, \DOMElement::class)) {
45+
+ throw new SerializationException(
46+
+ new Phrase('Invalid data type')
47+
+ );
48+
+ }
49+
$class = new ClassReflection($className);
50+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
51+
$className = substr($className, 0, -strlen('Interface'));
52+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
53+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
54+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
55+
@@ -35,6 +35,7 @@
56+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
57+
{
58+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
59+
+ $this->keys = [end($this->keys)];
60+
//Making sure keys are large enough.
61+
foreach ($this->keys as &$key) {
62+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.6.patch

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index 9d7fd443508..65987772c23 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -275,6 +275,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
// convert to string directly to avoid situations when $className is object
25+
// which implements __toString method like \ReflectionObject
26+
$className = (string) $className;
27+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
28+
+ || is_subclass_of($className, \DOMElement::class)) {
29+
+ throw new SerializationException(
30+
+ new Phrase('Invalid data type')
31+
+ );
32+
+ }
33+
$class = new ClassReflection($className);
34+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
35+
$className = substr($className, 0, -strlen('Interface'));
36+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
37+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
38+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
39+
@@ -35,6 +35,7 @@
40+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
41+
{
42+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
43+
+ $this->keys = [end($this->keys)];
44+
//Making sure keys are large enough.
45+
foreach ($this->keys as &$key) {
46+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting_2.4.7.patch renamed to ‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.7.patch

File renamed without changes.

0 commit comments

Comments
 (0)