Mercurial > p > roundup > code
diff doc/announcement.txt @ 8062:28aa76443f58
fix(security): fix CVE-2024-39124, CVE-2024-39124, and CVE-2024-39125
Directions for fixing:
* `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
tracker homes.
* `CVE-2024-39125`_ - :ref:`if Referer header is set to a script
tag, it will be executed. <CVE-2024-39125>` Fixed in release 2.4.0,
directions available for fixing in prior versions.
* `CVE-2024-39126`_ - :ref:`PDF, XML and SVG files downloaded from
an issue can contain embedded JavaScript which is
executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
available for fixing in prior versions.
prior to 2.4.0 release this weekend that fixes the last two CVE's.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 09 Jul 2024 09:07:09 -0400 |
| parents | 2a1bfa4db6be |
| children | a4cb4e75d4e9 |
line wrap: on
line diff
--- a/doc/announcement.txt Mon Jul 08 13:04:05 2024 -0400 +++ b/doc/announcement.txt Tue Jul 09 09:07:09 2024 -0400 @@ -4,7 +4,7 @@ <https://www.roundup-tracker.org/docs/upgrading.html>`_ to bring your tracker up to date. -The 67 changes, as usual, include some new features and many +The 79 changes, as usual, include some new features and many bug fixes. Note that you should run ``roundup-admin ... migrate`` to @@ -22,12 +22,16 @@ then unpack and test/install from the tarball. -Beta 2 includes a small change to the classic tracker's -classhelper.js to fix a bug found after beta 1 was released. - Among the notable improvements in 2.4.0 from the 2.3.0 release are: +* three CVE's have been fixed. One requires changes to your + tracker's home directory. The other two are fixed by + installing 2.4.0. See + https://www.roundup-tracker.org/docs/security.html for + details and instructions on how to fix these in 2.4.0 and + earlier releases. + * new classhelper component thanks to a team of students from CS682 at U-Mass Boston. This fixes many issues with the old classhelper. It is implemented as a web-component @@ -87,7 +91,7 @@ * sqlite version 1 and StructuredText support removed. The file CHANGES.txt has a detailed list of feature -additions and bug fixes (67) for each release. The most +additions and bug fixes for each release. The most recent changes from there are at the end of this announcement. Also see the information in doc/upgrading.txt.