Critical security update to Flarum core, with new incident write-up (v1.0.2)

Prcek

peopleinside Yeah, you are absolutely right 👍 This is the first time I forgot to run php flarum migrate after upgrade. So I wondered what my eyes saw 😁

Justoverclock

flarum.it, update ok 🙂

luceos

peopleinside @davwheat you may need add the security alert also on GitHub https://github.com/flarum/core/security/advisories

Yeah we are working on that.

davwheat

peopleinside

A security advisory for this vulnerability has been published on GitHub: https://github.com/flarum/core/security/advisories/GHSA-5qjq-69w6-fg57

Zeokat

First Stable first CVE with score 10 😅

luceos

Zeokat it was quite a challenge, but I think we nailed it 🙈🤯

pupsik

I fixed my error, by uninstalling gamification, and installing it back on 1.0.2.

Star

Isn't there any extension can be used for rss now?

[deleted]

Star Isn't there any extension can be used for rss now?

Try this: https://discuss.flarum.org/d/27569-rss-feed

Justman10000

What was the security hole?

GreXXL

Justman10000 you can read the security advisory on Github for the full information.

Justman10000

GreXXL

This still works?

luceos

Justman10000 have you cleared your cache (php flarum cache:clear)?

Justman10000

luceos

Uff! Forgot 😂

davwheat

Hey all!

We've updated the initial post to include a full write-up of the incident, including what went wrong and how we could improve next time.

This write-up contains full details of the exploit and how it was remediated. If you have not yet updated from v1.0.0 or v1.0.1 to v1.0.2, you should do so immediately.

JoshuaPack

Good work in clearing this up ASAP. Thanks for all your hard work!

adminmatthew

is Freeflarum automatically updated to the latest version??
or how can the admin update it?

peopleinside

adminmatthew Flarum is not updated automatically.
You need follow the forum actualy under the tag https://discuss.flarum.org/t/meta. You can subscrive to be ntified when a post is made on this tag.

Then for update you need read the instruction on the announcement of each release.

adminmatthew

peopleinside But does FREEFLARUM get updated automatically?

« Previous Page