Skip to content

v1.88.0

Latest
Latest

Choose a tag to compare

View all tags
@skshetry skshetry released this 01 Oct 09:35
· 2 commits to master since this release
v1.88.0
ef369be
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Important note: Action hooks can no longer send requests to internal addresses (loopback, private, link-local) by default. Allow the internal hosts your hooks need with actions.network.allowed_hosts. Hook requests no longer use the HTTP_PROXY/HTTPS_PROXY environment variables.

Security Fixes

  • Fixed a vulnerability that allowed users who can write action files to make the lakeFS server send requests to internal addresses (GHSA-223c-qwgx-wwcg)
  • S3 gateway now rejects SigV4 requests with unsigned x-amz-* headers (GHSA-96f7-c79c-crg8)
Assets 9
Loading