What are the detailed rules for Merkle tree generation? Specifically the order of the leaf nodes

Question

As far as I know, the first one is the coinbase transaction

Answer 1

The leaf nodes are in the same order as the transactions in the block. This order is chosen by the miners (other than the coinbase being first).

Please see here for more info: https://bitcoin.stackexchange.com/a/46768/51948

CVE-2012-2459 is detailed here. The relevant fix:

The problem was fixed by Gavin Andresen in Bitcoin commit be8651d [1] by rejecting blocks with duplicate transactions in CheckBlock, preventing them from being cached at all.

So essentially the Merkle tree itself still has the same issue, but it can never be a problem in practice when used in Bitcoin blocks.