HomeFreeBSD

www/glpi: update to 10.0.15 (CVE-2024-31456, CVE-2024-29889)

Description

www/glpi: update to 10.0.15 (CVE-2024-31456, CVE-2024-29889)

Mostly a security release (2 high severity security fixes).

ChangeLog:
https://github.com/glpi-project/glpi/releases/tag/10.0.15

This release fixes a few security issues that have been recently discovered.
Update is recommended!
You will find below the list of security issues fixed in this bugfixes version:

  • [SECURITY - high] Authenticated SQL injection from map search (CVE-2024-31456)
  • [SECURITY - high] Account takeover via SQL Injection in saved searches feature

(CVE-2024-29889)

Also, here is a short list of main changes done in this version:

  • [FIX] Fix used right by reservation form.
  • [FIX] Do not rely on input to apply rules rights.
  • [FIX] Always store updated SMTP Oauth refresh token.
  • [TASK] Upgrade tinymce.

PR: 278641
MFH: 2024Q2
(cherry picked from commit 35c59aa6e4e0930a98b482bfc3594ec9cd53bf19)

Details

Provenance
Mathias Monnerville <mathias@monnerville.com>Authored on Mon, Apr 29, 10:16 AM
vvdCommitted on Mon, Apr 29, 10:34 AM
Parents
R11:02afd2d3a6c1: www/gitlab: security and patch update to 16.11.1
Branches
Unknown
Tags
Unknown

Event Timeline