Skip to content

v3.3.1
Compare
Choose a tag to compare
@stripthis stripthis released this 24 Nov 16:09
· 2221 commits to master since this release
v3.3.1
d919298
This commit was signed with the committer’s verified signature.
Tecnobutrul Daniel Del Rio
GPG key ID: DCB25219AF061D1B
Learn about vigilant mode.

[3.3.0] - 2021-11-24

As part of the audit of the mobile application, security researcher Johannes Dahse, from Cure53 team, found that the Passbolt API v3.3 is prone to a key confusion attack. The JWT Authentication is currently in beta, and the plugin is disabled by default. This issue however affects users that have enabled the plugin to test the Mobile apps they should either disable it or update now.

More info

Security fix

  • PBL-06-008 Fix JWT key confusion leads to authentication bypass (High) (BETA)
Assets 2