openflagr/flagr

[Security] Vulnerability found

nbeguier opened this issue · 4 comments

nbeguier commented

I've found a "critical vulnerability" (in my opinion) on Flagr 1.1.12, who can I contact ?

Your Environment

  • Version used (flagr version): 1.1.12
  • Server type and version: any
  • Operating System and version (uname -a): any
zhouzhuojie commented

@ivanRylach @sesquipedalian-dev

I'm also available at https://keybase.io/zhuojie for encrypted messages

nbeguier commented

It's been 90 days since my report and you successfully fix the issue. You may want to release v1.1.13 because I'll probably disclose the PoC in the following weeks, as agreed.
@zhouzhuojie

zhouzhuojie commented

It's been 90 days since my report and you successfully fix the issue. You may want to release v1.1.13 because I'll probably disclose the PoC in the following weeks, as agreed.
@zhouzhuojie

Hey @nbeguier, thanks for reporting again. I don't have the write permission to this repo anymore, @marceloboeira and I are thinking of maintaining a new community version of flagr with strict API backward compatibility of course, see the new release cut there.

https://github.com/openflagr/flagr/releases/tag/1.1.13

  • 👍3
github-actions commented

Stale issue message