[sln] Update version to be in line with security hotfix release
This avoids "am I vulnerable to this?" confusion if running a :dev image or a -git package.
This commit is contained in:
parent
fe8c736821
commit
328c3a5c91
2 changed files with 14 additions and 1 deletions
13
CHANGELOG.md
13
CHANGELOG.md
|
@ -1,3 +1,16 @@
|
||||||
|
## v2024.1-beta4.security1
|
||||||
|
This is a security hotfix release. It's identical to v2024.1-beta4, except for the security mitigations listed below. Upgrading is strongly recommended for all server operators.
|
||||||
|
|
||||||
|
### Backend
|
||||||
|
- ActivityPub actor and note validation has been improved & now protects against cross-origin identifiers in more places, resolving a database pollution vulnerability
|
||||||
|
- Cross-origin `url` properties on actor & note objects now get set to null before ingestion, resolving a clickjacking vulnerability
|
||||||
|
- User resolution when processing incoming notes is now limited
|
||||||
|
|
||||||
|
### Attribution
|
||||||
|
This release was made possible by project contributors: Laura Hausmann
|
||||||
|
|
||||||
|
Furthermore, I want to give special thanks to Hazel Koehler for the vulnerability disclosure.
|
||||||
|
|
||||||
## v2024.1-beta4
|
## v2024.1-beta4
|
||||||
This release contains lots of new features & bug fixes, including security fixes. Upgrading is strongly recommended for all server operators.
|
This release contains lots of new features & bug fixes, including security fixes. Upgrading is strongly recommended for all server operators.
|
||||||
|
|
||||||
|
|
|
@ -27,7 +27,7 @@
|
||||||
<!-- Version metadata -->
|
<!-- Version metadata -->
|
||||||
<PropertyGroup>
|
<PropertyGroup>
|
||||||
<VersionPrefix>2024.1</VersionPrefix>
|
<VersionPrefix>2024.1</VersionPrefix>
|
||||||
<VersionSuffix>beta4</VersionSuffix>
|
<VersionSuffix>beta4.security1</VersionSuffix>
|
||||||
</PropertyGroup>
|
</PropertyGroup>
|
||||||
|
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
|
|
Loading…
Add table
Reference in a new issue