[GHSA-fppq-f2m6-xv5c] Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8,...

[ihor-sviziev]

Updates

• Affected products
• Summary

Comments
Add suggested packages

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• advisories/unreviewed/2025/02/GHSA-fppq-f2m6-xv5c/GHSA-fppq-f2m6-xv5c.json: Language not supported

[ihor-sviziev]

Just to clarify - Magento/Adobe uses its own private composer repository for package delivery (more details here https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/composer#get-the-metapackage )
Because of that

• magento/community-edition - publicly available for everyone, but almost no one uses it
• magento/magento2-base - available for everyone using Adobe's composer repo

The list of packages that delivered though can be found for instance here (it's not up to date with the recent security patch yet):
https://github.com/magento/quality-patches/blob/master/magento_releases.json#L3-L12

However, the list of private packages is widely used in repositories as installed package, you can find some samples here https://github.com/search?q=magento%2Fmagento2-base+path%3A*.lock&type=code

Basically, the same changes has to be applied to all of these: https://github.com/advisories?query=type%3Aunreviewed+Adobe+Commerce+versions+2.4.7-beta1

[advisory-database]

Hi @ihor-sviziev! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[JonathanLEvans]

Hi @ihor-sviziev, thank you for your contribution. We are publishing the advisory based on your contribution. However, the magento/magento2-base package is out of scope for the database.