Skip to content

release-3.9.1

Latest
Latest

Choose a tag to compare

View all tags
@farhatahmad farhatahmad released this 05 Nov 19:03
release-3.9.1
6b57174
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Notes

What's Changed

Security Fixes

This release fixes a critical vulnerability. All administrators should upgrade immediately.

  • Fixed: arbitrary file read/write through image uploads (Critical).
    Greenlight processes uploaded avatars and presentations with ImageMagick. Through GHSA-f3w6-w445-fwh9 in Rails' Active Storage, a user who can upload a file could read or write files on the server. This release upgrades to Rails 8.0.5.2, which applies a restrictive ImageMagick security policy to all image processing

Action required after upgrading

If your instance stores uploads on local disk (the default, i.e. you have not configured S3 or Google Cloud Storage), assume that secrets readable by the application may have been exposed, and rotate them:

  • SECRET_KEY_BASE. Changing it signs every user out.
  • Database password (DATABASE_URL)
  • BIGBLUEBUTTON_SECRET
  • SMTP, OpenID Connect, S3/GCS and any other credentials in your environment
Assets 2
Loading