Magento 1.x security patch SUPEE-9652

[goivvy]

Magento 1.x team just released a security patch SUPEE-9652

https://magento.com/security/patches/supee-9652

It addresses Zend library vulnerability

you are vulnerable if you are using sendmail as mail transport agent.

if you are not sure you should patch ASAP.

you can find all the info and download a patch following the link above.

 

[edmondscommerce]

Oh they do keep us busy with these patches

Much better than leaving the vulnerabilities unpatched though!

I do wonder whats going to happen when 1.x goes end of life...

I highly doubt they will stop finding vulnerabilities, but what will happen about patching - a community effort of some description?

It's going to be interesting

 

[edmondscommerce]

Looks like this is the official fix for https://magento.com/security/news/new-zend-framework-1-security-vulnerability

If use SMTP to send emails via GSuite (Google Apps) or use Amazon SES or anything else like that, then you are already fine - though its still worth patching just to be safe.

 

[goivvy]

Oh they do keep us busy with these patches

Much better than leaving the vulnerabilities unpatched though!

I do wonder whats going to happen when 1.x goes end of life...

I highly doubt they will stop finding vulnerabilities, but what will happen about patching - a community effort of some description?

It's going to be interesting

I guess it will be true open source with all good and bad that is in it

if someone comes up with a patch - fine

if not - just let it be

i am sure a number of hijacked magento 1.x will rise significantly


or it might be an opportunity for an expert to stand up and keep magento 1.x healthy for profit or benefits.

 

[edmondscommerce]

Having seen this play out with the demise of osCommerce and the growth of CRELoaded, ZenCart and some others

I fully expect a few offshoots of Magento 1.x to appear

Not sure if any will stick though. It's certainly an interesting time