Skip to content

Version 692

Choose a tag to compare

View all tags
@hydrusnetwork hydrusnetwork released this 24 Oct 20:21
· 43 commits to master since this release
v692
a7c9b73
This commit was signed with the committer’s verified signature.
hydrusnetwork Hydrus Network Developer
GPG key ID: 76249F053212133C
Verified
Learn about vigilant mode.

More information here
Full Release Post

security hotfix

  • An AI scanner has found a remote code execution bug in the hydrus client. This release fixes the issue. All users should update
  • the risk occurred when importing a user-made object like a downloader or when talking to a hydrus server like the PTR
  • EDIT: I originally thought the Client API was vulnerable, but additional testing has shown it was not.
  • The hydrus server was not vulnerable
  • After investigating the 5,000+ publicly shared downloaders on the user-run repo and 27,000+ PTR update files, I did not find any use of the exploit and am confident that there was no widespread use of the flaw. This is the time to update, in case the problem becomes real in the near future.
  • to help propagate the notice and make a hard split with unpatched clients, the hydrus network version has been bumped (to 21). Any client that tries to communicate with an updated server (which includes the PTR, which has just been updated) will get a message that they need to update.
  • The Client API also has a version bump, up to 96
Assets 5
Loading