Magento 2.2 patch for PRODSECBUG-2198 in composer.patches.json format for magento/module-catalog. See for magento/framework https://gist.github.com/peterjaap/433a07a08962ea8955e64b39c84cc4e3

PRODSECBUG-2198-2.2-CE-2019-03-25-08-43-16-module-catalog.patch

diff --git a/Model/Product/ProductFrontendAction/Synchronizer.php b/Model/Product/ProductFrontendAction/Synchronizer.php
index 7a1926c..331c667 100644
--- a/Model/Product/ProductFrontendAction/Synchronizer.php
+++ b/Model/Product/ProductFrontendAction/Synchronizer.php
@@ -138,7 +138,9 @@ class Synchronizer
         $productIds = [];
 
         foreach ($actions as $action) {
-            $productIds[] = $action['product_id'];
+            if (isset($action['product_id']) && is_int($action['product_id'])) {
+                $productIds[] = $action['product_id'];
+            }
         }
 
         return $productIds;
@@ -159,33 +161,37 @@ class Synchronizer
         $customerId = $this->session->getCustomerId();
         $visitorId = $this->visitor->getId();
         $collection = $this->getActionsByType($typeId);
-        $collection->addFieldToFilter('product_id', $this->getProductIdsByActions($productsData));
-
-        /**
-         * Note that collection is also filtered by visitor id and customer id
-         * This collection shouldnt be flushed when visitor has products and then login
-         * It can remove only products for visitor, or only products for customer
-         *
-         * ['product_id' => 'added_at']
-         * @var ProductFrontendActionInterface $item
-         */
-        foreach ($collection as $item) {
-            $this->entityManager->delete($item);
-        }
-
-        foreach ($productsData as $productId => $productData) {
-            /** @var ProductFrontendActionInterface $action */
-            $action = $this->productFrontendActionFactory->create([
-                'data' => [
-                    'visitor_id' => $customerId ? null : $visitorId,
-                    'customer_id' => $this->session->getCustomerId(),
-                    'added_at' => $productData['added_at'],
-                    'product_id' => $productId,
-                    'type_id' => $typeId
-                ]
-            ]);
-
-            $this->entityManager->save($action);
+        $productIds = $this->getProductIdsByActions($productsData);
+
+        if ($productIds) {
+            $collection->addFieldToFilter('product_id', $productIds);
+
+            /**
+             * Note that collection is also filtered by visitor id and customer id
+             * This collection shouldn't be flushed when visitor has products and then login
+             * It can remove only products for visitor, or only products for customer
+             *
+             * ['product_id' => 'added_at']
+             * @var ProductFrontendActionInterface $item
+             */
+            foreach ($collection as $item) {
+                $this->entityManager->delete($item);
+            }
+
+            foreach ($productsData as $productId => $productData) {
+                /** @var ProductFrontendActionInterface $action */
+                $action = $this->productFrontendActionFactory->create([
+                    'data' => [
+                        'visitor_id' => $customerId ? null : $visitorId,
+                        'customer_id' => $this->session->getCustomerId(),
+                        'added_at' => $productData['added_at'],
+                        'product_id' => $productId,
+                        'type_id' => $typeId
+                    ]
+                ]);
+
+                $this->entityManager->save($action);
+            }
         }
     }