Skip to content

2020.1.6

Compare
Choose a tag to compare
@SammyIsConfused SammyIsConfused released this 05 Nov 04:16
· 8566 commits to master since this release

This is the sixth hotfix for 2020.1 and contains the fixes for the security vulnerabilities around unauthenticated access to the select users dialog AND the fix for the security vulnerability around unauthenticated access to files within the 'manager' directory.
See GHSA-79w4-xjfh-9rmf and GHSA-vjw3-62cq-7xgg

Note: This hotfix introduces a new privilege, LIST_USERS, which protects the select users dialogs across openEQUELLA. After applying the hotfix, no users will be granted this privilege by default. Your administrators will need to grant this privilege to the relevant users/groups/roles.