2.8.10: שחרור אבטחה

News and Events הודעות

סיכום מבוסס בינה מלאכותית

Discourse 2.8.10 is a security release that addresses several critical vulnerabilities. The update includes fixes for restricted display of topic titles linked to user badges CVE-2022-39378, expanded SSRF protections CVE-2022-39241, and invite link email validation CVE-2022-39356. Additionally, multiple plugins have been updated for security, including Patreon, Chat (XSS vulnerability CVE-2022-39279), Chat Integration, OAuth2 Basic, and OpenID Connect, all of which had SSRF-related issues CVE-2022-39241. The release emphasizes that all sites should follow the tests-passed branch for production readiness, as it prioritizes bug-free stability over minimal changes. jomaxro highlights the importance of updating both Discourse and plugins to mitigate risks.

1

Discourse 2.8.10 Stable Release

Discourse strongly recommends that all sites follow the default tests-passed branch of Discourse. The “stable” branch is more focused on lack of change than lack of bugs - all releases, including those on tests-passed and beta are production ready.

Changes

Security:

Plugin Security Updates

Multiple plugins have also received security fixes. Be sure to update plugins in addition to Discourse.

4 לייקים