Skip to content

11.0.313

Latest
Latest

Choose a tag to compare

View all tags
@adubovikov adubovikov released this 08 Aug 17:20
11.0.313
6b2ce90
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • fix(security): harden node /query auth and block sqlite_scan by @adubovikov in #927

Security

  • GHSA-rm5w-rqr7-2h54: Node HTTP POST /query (port+1) now always runs ValidateRawSQL; Bearer auth when flight_server.auth_token is set; auto-token on non-loopback binds (.homer_node_auth_token). Coordinator sends nodes[].token.
  • GHSA-4687-q698-mccv: Block sqlite_scan and other DuckDB external scanners in ValidateRawSQL.

See SECURITY.md.

Full Changelog: 11.0.312...11.0.313

Contributors

adubovikov
Assets 8
Loading