backdoor still present in app.db

[euri10]

the README states the following

03.07.18: New build pushed, all versions below 67 have vulnerability

However a quick inspect on https://github.com/linuxserver/docker-calibre-web/blob/master/root/defaults/app.db that is pushed by default when building the image reveals it still contains the Guest user mentioned in upstream project janeczku/calibre-web#534

➜  Downloads wget https://github.com/linuxserver/docker-calibre-web/raw/master/root/defaults/app.db
--2019-01-03 18:28:36--  https://github.com/linuxserver/docker-calibre-web/raw/master/root/defaults/app.db
Resolving github.com (github.com)... 140.82.118.3, 140.82.118.4
Connecting to github.com (github.com)|140.82.118.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/linuxserver/docker-calibre-web/master/root/defaults/app.db [following]
--2019-01-03 18:28:36--  https://raw.githubusercontent.com/linuxserver/docker-calibre-web/master/root/defaults/app.db
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.120.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.120.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 36864 (36K) [application/octet-stream]
Saving to: ‘app.db’

app.db                        100%[================================================>]  36.00K  --.-KB/s    in 0.008s

2019-01-03 18:28:36 (4.59 MB/s) - ‘app.db’ saved [36864/36864]

➜  Downloads sqlite3 app.db
SQLite version 3.26.0 2018-12-12 11:57:35
Enter ".help" for usage hints.
sqlite> SELECT * FROM user;
1|admin||159|pbkdf2:sha256:50000$j8XQXKMn$599892baba5edb4c411d73a0a308ee4345983602be138b60c08d8f0e3adb934b||en|511|all
2|Guest|no@email|32|pbkdf2:sha256:50000$uCxUkQuC$4c25b03ec40099a0de2370110bda6881b1351f4d809eaadb25cd9e3c26f18daf||en|1|all
sqlite>

[CHBMB]

@euri10 I've replaced the default app.db and removed the guest user. Interestingly I think the vulnerability was fixed with this commit and the files cps/ub.py & cps/web.py and using this default app.db I wasn't able to login to the webui using those credentials, so not sure this was still an ongoing problem.