Skip to content

Commit

Permalink
www/kanboard: update to 1.2.30
Browse files Browse the repository at this point in the history
ChangeLog: https://github.com/kanboard/kanboard/releases/tag/v1.2.30

 * CVE-2023-33956: Parameter based Indirect Object Referencing leading to private
   file exposure
 * CVE-2023-33968: Missing access control allows user to move and duplicate tasks
   to any project in the software
 * CVE-2023-33969: Stored XSS in the Task External Link Functionality
 * CVE-2023-33970: Missing access control in internal task links feature

 * Avoid PHP warning caused by session_regenerate_id()
 * Avoid CSS issue when upgrading to v1.2.29 without flushing user sessions

Reported by:	portscout
MFH:		2023Q2 (security release)
Security:	CVE-2023-33956 CVE-2023-33968 CVE-2023-33969 CVE-2023-33970
  • Loading branch information
fernape committed Jun 6, 2023
1 parent d426165 commit ad5f302
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 5 deletions.
3 changes: 1 addition & 2 deletions www/kanboard/Makefile
@@ -1,7 +1,6 @@
PORTNAME= kanboard
DISTVERSIONPREFIX= v
DISTVERSION= 1.2.29
PORTREVISION= 1
DISTVERSION= 1.2.30
CATEGORIES= www
PKGNAMEPREFIX= ${PHP_PKGNAMEPREFIX}

Expand Down
6 changes: 3 additions & 3 deletions www/kanboard/distinfo
@@ -1,3 +1,3 @@
TIMESTAMP = 1685352903
SHA256 (kanboard-kanboard-v1.2.29_GH0.tar.gz) = bd5a67e5054054be7a9d6ef6b75f2e5b813da5592d96c4dea0c8fff6b6e36451
SIZE (kanboard-kanboard-v1.2.29_GH0.tar.gz) = 3253347
TIMESTAMP = 1685946635
SHA256 (kanboard-kanboard-v1.2.30_GH0.tar.gz) = cf7b8437053ac29323523841a224f43c4859e1a6440347ccd78095dfda8788d2
SIZE (kanboard-kanboard-v1.2.30_GH0.tar.gz) = 3253809

0 comments on commit ad5f302

Please sign in to comment.