Magento 2.0.6 Provides Important Security and Functional Updates
Today, we are releasing Magento Enterprise Edition and Community Edition 2.0.6, which contain important functional improvements. You can now use Redis for session storage and a file permission issue has been fixed by providing a more flexible way to set file ownership. Full details on the functional enhancements are included in the release notes for Enterprise Edition and Community Edition.
Additionally, the release has several security improvements, including:
Stopping unauthenticated users from using REST or SOAP API calls to remotely execute malicious code on the server.
Preventing a site from being remotely triggered to reinstall itself so that the attacker can potentially take control of it.
No longer allowing authenticated customers to change other customers’ account information using SOAP or REST API calls.
Fully resolving a previous vulnerability with cross-site scripting in the Authorize.net payment module.
If you have not previously upgraded to Magento Enterprise Edition 2.0.2 or later releases, you should review the upgrade information posted on our Security Center as there are some additional steps you may need to take. This update should be installed and tested in a development environment before being put into production. Also, please use this occasion to do a security assessment in accordance with our Security Best Practices.
Thank you for your prompt attention to these issues.