Commerce 0.10.3 pre-disclosure

[mhamstra (Mark Hamstra)]

On January 9th we released Commerce 0.10.3 with an important security fix. Disclosure for that bug is planned for February 12th.

Commerce 0.10.3: important security fix

Edit Feb 12: the disclosure can now be found here:

Disclosure: Information disclosure vulnerability fixed in 0.10.3

On January 9th, we released Commerce 0.10.3 which includes a fix for an information disclosure vulnerability. Our limited early announcement did not include specific information about the vulnerability, to protect existing users from being exploited before they had a chance to upgrade. In this full disclosure we want to share with you more details of what happened. Vulnerability In the checkout, Commerce needs to keep track of the current order information. It uses two methods for this: some d…