Security patching for Quince
cmltaWt0 opened this issue · 6 comments
This is a Quince security patching request.
@ormsbee published a security advisory last week (forums post here).
The fix was merged to master and backported to redwood and quince master branches.
open-release/quince.master: fix: prevent setting user attributes from JWT in Studio · openedx/edx-platform@3ff69fd · GitHub 2
As discussed during BTR WG meeting - we want to patch the edx-platform via the build process in Tutor and publish a
patch release (17.0.5?).
Just to clarify: you mentioned v16.1.9, but I think you really meant 17.0.5? We want to patch Quince, not Palm, right?
Yeah, we are going for 17.0.5. The security patch upstream has been merged to master, redwood.master, and quince.master. We don't need any action for palm.
@regisb @DawoudSheraz Ma bad. 17.0.5 👍
I've updated the description.
PR for changes in dockerfile #1068.
Once merged, a followup PR will be created for v17.0.5 release.
PR #1069 for v17.0.5 release