Skip to content

v1.34.0

Choose a tag to compare

View all tags
@gavinbarron gavinbarron released this 08 Jul 20:03
v1.34.0
9d4f80e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changed

Fixed a path traversal vulnerability where workspace consumer identifiers (clientName/pluginName) and workspace configuration keys were used as filesystem path components without containment validation, allowing a crafted name (e.g. junk/../Victim) to overwrite another consumer's cached OpenAPI description. #7919

Full Changelog: v1.33.0...v1.34.0

Assets 14
Loading