Skip to content

Release 1.16.1

Latest

Choose a tag to compare

@brettmc brettmc released this 06 Nov 02:32
· 3 commits to main since this release

Security

  • The host detector ran ioreg, kenv and powershell.exe through a shell, so they were
    looked up on PATH, and on Windows in the current directory. A program placed there ran
    instead. It runs /usr/sbin/ioreg, /bin/kenv and reg.exe by absolute path, without a
    shell (GHSA-fc6f-cp96-6g5w).
  • When the host id lookup failed, host.id was "" on macOS and Windows, or /bin/kenv on
    BSD. It is left out instead (GHSA-fc6f-cp96-6g5w).

Full Changelog: 1.16.0...1.16.1