hello, We’ve received an alert from this CVE that an instance of discourse is vulnerable to https://www.cve.org/CVERecord?id=CVE-2022-31096 It is said that the fix is in 2.9.0.beta6 but I’m unable to find and upgrade to that version. Is anyone else having this problem?

You’re right, the patch is there: https://github.com/discourse/discourse/commit/115859964d6e3e92d6d933ffe8e1b330b12a3aca but there has not been any bump in version since :thinking:

We do a beta bump for a high severity CVE shortly after the fix is released, but we missed to do that for the last CVE (CVE-2022-31096). We released 2.9.0.beta6 last week (Thursday) so this should be resolved now. [image] 2.9.0.beta6: Whisper Improvements, Loading Splash Screen, Security Fix, and more megaphoneAnnouncements New features in 2.9.0.beta6 Whispers now support groups Whispers are a great way for staff to communicate within a topic, without their post becoming public. Staff might share their thoughts on how to reply to a post, or discuss with each other whether to close a topic. Historically, whispers were a staff-only features. Users needed to be admins or moderators to see (and post) whispers. Now, using the whispers allowed groups site setting, additional groups can be granted permission to whisper. …

Unable to find discourse version 2.9.0.beta6

Product Support

pfaffman (Jay Pfaffman) June 30, 2022, 11:02am 8

You can upgrade now and that commit will be applied. It’s not a critical security issue, so they didn’t bump the version to push it out.

Topic		Replies	Views
Your Discourse installation is out of date. Click here to upgrade Self-hosting	1	407	December 6, 2023
Do I need to upgrade to version 1.8.0.beta11? Product Support	22	2182	May 7, 2017
Up to date with 2.6.0.beta1 Product Support	4	1188	August 20, 2020
Discourse Upgrade Not Working Product Support	3	224	November 5, 2024
Stable version upgrade to 2.4.0 Product Support	4	820	February 27, 2020

Unable to find discourse version 2.9.0.beta6

Related topics