Skip to content

Commit 4f3f903

Browse files
sivaram7sivaram7
committed
Merge branch 'develop' into 1.1
2 parents 1e4b731 + fb7022e commit 4f3f903

10 files changed

+879
-1
lines changed

‎composer.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "magento/magento-cloud-patches",
33
"description": "Provides critical fixes for Magento 2 Enterprise Edition",
44
"type": "magento2-component",
5-
"version": "1.1.1",
5+
"version": "1.1.2",
66
"license": "OSL-3.0",
77
"repositories": {
88
"repo.magento.com": {

‎patches.json

+12
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,18 @@
280280
},
281281
"Enhanced Layout Cache Efficiency (memory usage reduced)": {
282282
">=2.4.4 <2.4.7": "MCLOUD-11514__enhanced_layout_cache_efficiency__2.4.6-p3.patch"
283+
},
284+
"Patch for CVE-2024-34102 - CosmicSting": {
285+
">=2.4.4 <2.4.4-p8": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.4.patch",
286+
">=2.4.5 <2.4.5-p7": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.5.patch",
287+
">=2.4.6 <2.4.6-p5": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.6.patch",
288+
"2.4.7": "MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.7.patch"
289+
},
290+
"Patch for CVE-2024-34102 - KeyRotation": {
291+
">=2.4.4 <2.4.4-p10": "MCLOUD-12969__Patch_for_CVE_2024_34102_KeyRotation__2.4.4.patch",
292+
">=2.4.5 <2.4.5-p9": "MCLOUD-12969__Patch_for_CVE_2024_34102_KeyRotation__2.4.5.patch",
293+
">=2.4.6 <2.4.6-p7": "MCLOUD-12969__Patch_for_CVE_2024_34102_KeyRotation__2.4.6.patch",
294+
">=2.4.7 <2.4.7-p2": "MCLOUD-12969__Patch_for_CVE_2024_34102_KeyRotation__2.4.7.patch"
283295
}
284296
},
285297
"magento/module-paypal": {

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.4.patch

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index 908a4e70140..cc019845b58 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -153,6 +153,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
* @return \Magento\Framework\Reflection\NameFinder
25+
*
26+
* @deprecated 100.1.0
27+
+ * @see nothing
28+
*/
29+
private function getNameFinder()
30+
{
31+
@@ -261,6 +262,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
32+
* @throws \Exception
33+
* @throws SerializationException
34+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
35+
+ * @SuppressWarnings(PHPMD.NPathComplexity)
36+
*/
37+
protected function _createFromArray($className, $data)
38+
{
39+
@@ -268,6 +270,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
40+
// convert to string directly to avoid situations when $className is object
41+
// which implements __toString method like \ReflectionObject
42+
$className = (string) $className;
43+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
44+
+ || is_subclass_of($className, \DOMElement::class)) {
45+
+ throw new SerializationException(
46+
+ new Phrase('Invalid data type')
47+
+ );
48+
+ }
49+
$class = new ClassReflection($className);
50+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
51+
$className = substr($className, 0, -strlen('Interface'));
52+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
53+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
54+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
55+
@@ -35,6 +35,7 @@
56+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
57+
{
58+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
59+
+ $this->keys = [end($this->keys)];
60+
//Making sure keys are large enough.
61+
foreach ($this->keys as &$key) {
62+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.5.patch

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index a5e881f4be5..a60f1dd7ba1 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -153,6 +153,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
* @return \Magento\Framework\Reflection\NameFinder
25+
*
26+
* @deprecated 100.1.0
27+
+ * @see nothing
28+
*/
29+
private function getNameFinder()
30+
{
31+
@@ -261,6 +262,7 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
32+
* @throws \Exception
33+
* @throws SerializationException
34+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
35+
+ * @SuppressWarnings(PHPMD.NPathComplexity)
36+
*/
37+
protected function _createFromArray($className, $data)
38+
{
39+
@@ -268,6 +270,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
40+
// convert to string directly to avoid situations when $className is object
41+
// which implements __toString method like \ReflectionObject
42+
$className = (string) $className;
43+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
44+
+ || is_subclass_of($className, \DOMElement::class)) {
45+
+ throw new SerializationException(
46+
+ new Phrase('Invalid data type')
47+
+ );
48+
+ }
49+
$class = new ClassReflection($className);
50+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
51+
$className = substr($className, 0, -strlen('Interface'));
52+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
53+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
54+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
55+
@@ -35,6 +35,7 @@
56+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
57+
{
58+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
59+
+ $this->keys = [end($this->keys)];
60+
//Making sure keys are large enough.
61+
foreach ($this->keys as &$key) {
62+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.6.patch

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
2+
index a491a567a37..5e8bef787d2 100644
3+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
5+
@@ -4,3 +4,4 @@ Summary,Summary
6+
Menu,Menu
7+
Account,Account
8+
Settings,Settings
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
11+
index 7bf9e0afaf0..00493cc05ba 100644
12+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
14+
@@ -54,3 +54,4 @@ Footer,Footer
15+
"Update to your %store_name shipment","Update to your %store_name shipment"
16+
"Address Book","Address Book"
17+
"Account Information","Account Information"
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
20+
index 9d7fd443508..65987772c23 100644
21+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
22+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
23+
@@ -275,6 +275,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface
24+
// convert to string directly to avoid situations when $className is object
25+
// which implements __toString method like \ReflectionObject
26+
$className = (string) $className;
27+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
28+
+ || is_subclass_of($className, \DOMElement::class)) {
29+
+ throw new SerializationException(
30+
+ new Phrase('Invalid data type')
31+
+ );
32+
+ }
33+
$class = new ClassReflection($className);
34+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
35+
$className = substr($className, 0, -strlen('Interface'));
36+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
37+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
38+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
39+
@@ -35,6 +35,7 @@
40+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
41+
{
42+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
43+
+ $this->keys = [end($this->keys)];
44+
//Making sure keys are large enough.
45+
foreach ($this->keys as &$key) {
46+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

‎patches/MCLOUD-12969__Patch_for_CVE_2024_34102_CosmicSting__2.4.7.patch

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
diff --git a/vendor/magento/theme-adminhtml-backend/i18n/en_US.csv b/vendor/magento/theme-adminhtml-backend/i18n/en_US.csv
2+
index 2708988e731..885d0056d4b 100644
3+
--- a/vendor/magento/theme-adminhtml-backend/i18n/en_US.csv
4+
+++ b/vendor/magento/theme-adminhtml-backend/i18n/en_US.csv
5+
@@ -547,3 +547,4 @@ Dashboard,Dashboard
6+
"Web Section","Web Section"
7+
"Store Email Addresses Section","Store Email Addresses Section"
8+
"Email to a Friend","Email to a Friend"
9+
+"Invalid data type","Invalid data type"
10+
diff --git a/vendor/magento/theme-frontend-blank/i18n/en_US.csv b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
11+
index 025866f654d..cc02ab5ac90 100644
12+
--- a/vendor/magento/theme-frontend-blank/i18n/en_US.csv
13+
+++ b/vendor/magento/theme-frontend-blank/i18n/en_US.csv
14+
@@ -439,3 +439,4 @@ Summary,Summary
15+
Test,Test
16+
test,test
17+
Two,Two
18+
+"Invalid data type","Invalid data type"
19+
diff --git a/vendor/magento/theme-frontend-luma/i18n/en_US.csv b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
20+
index e80cb58e679..3d0e8ab2650 100644
21+
--- a/vendor/magento/theme-frontend-luma/i18n/en_US.csv
22+
+++ b/vendor/magento/theme-frontend-luma/i18n/en_US.csv
23+
@@ -489,3 +489,4 @@ Remove,Remove
24+
Test,Test
25+
test,test
26+
Two,Two
27+
+"Invalid data type","Invalid data type"
28+
diff --git a/vendor/magento/framework/Webapi/ServiceInputProcessor.php b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
29+
index cd7960409e1..df31058ff32 100644
30+
--- a/vendor/magento/framework/Webapi/ServiceInputProcessor.php
31+
+++ b/vendor/magento/framework/Webapi/ServiceInputProcessor.php
32+
@@ -278,6 +278,12 @@ class ServiceInputProcessor implements ServicePayloadConverterInterface, ResetAf
33+
// convert to string directly to avoid situations when $className is object
34+
// which implements __toString method like \ReflectionObject
35+
$className = (string) $className;
36+
+ if (is_subclass_of($className, \SimpleXMLElement::class)
37+
+ || is_subclass_of($className, \DOMElement::class)) {
38+
+ throw new SerializationException(
39+
+ new Phrase('Invalid data type')
40+
+ );
41+
+ }
42+
$class = new ClassReflection($className);
43+
if (is_subclass_of($className, self::EXTENSION_ATTRIBUTES_TYPE)) {
44+
$className = substr($className, 0, -strlen('Interface'));
45+
diff --git a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php
46+
--- a/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 022e64b08a88658667bc2d6b922eada2b7910965)
47+
+++ b/vendor/magento/module-jwt-user-token/Model/SecretBasedJwksFactory.php (revision 8d2b0c1c6b421cdcd7f62a48a5edc9b0211d92a2)
48+
@@ -35,6 +35,7 @@
49+
public function __construct(DeploymentConfig $deploymentConfig, JwkFactory $jwkFactory)
50+
{
51+
$this->keys = preg_split('/\s+/s', trim((string)$deploymentConfig->get('crypt/key')));
52+
+ $this->keys = [end($this->keys)];
53+
//Making sure keys are large enough.
54+
foreach ($this->keys as &$key) {
55+
$key = str_pad($key, 2048, '&', STR_PAD_BOTH);

0 commit comments

Comments
 (0)