New Solidus releases to address security vulnerabilities

Today we're disclosing several security vulnerabilities affecting Solidus and its frontends:

• GHSA-92gv-2pxv-7gjg: Unauthenticated tampering with and disclosure of guest-checkout credit cards via nil-user ability
• GHSA-c2fq-w6qj-3hj4: Arbitrary payment amounts via the orders and payments APIs enable order underpayment
• GHSA-qj34-2493-vx9f: Guest token fixation in Solidus Frontend enables cart takeover and order data disclosure
• GHSA-g82m-w3m9-rrwh: Guest token fixation in Solidus Storefront enables cart takeover and order data disclosure

The first two affect Solidus itself and can be addressed by upgrading to Solidus 4.7.1 or 4.6.3.

The last two are the same vulnerability, affecting Solidus Frontend or Solidus Storefront respectively. If you use Solidus Frontend, you should upgrade solidus_frontend to either 4.7.1 or 4.6.3, depending on your Solidus version. If you use Solidus Storefront, be aware that because it generates code into your application, upgrading your gems is not enough to resolve this vulnerability: you must update your application's own code as described in the advisory.

You can read about these vulnerabilities on the Solidus mailing list.

If you have any questions about how to secure your site please stop by our Slack http://slack.solidus.io/.

Have a nice day!