Comparing 4c1d418823..21121e8bc1 - meet

gsadmin/meet

Fork 0

mirror of https://github.com/suitenumerique/meet.git synced 2026-10-23 21:15:23 +00:00

Author	SHA1	Message	Date
briquet	21121e8bc1	🔒️(backend) upgrade djangorestframework to 3.18.2 Fix three vulnerabilities in djangorestframework - CVE-2026-114136: a compressing codec in the Content-Type charset lets an unauthenticated body bypass Django's size limit, causing memory-amplification denial of service - CVE-2026-114137: TokenProxy.delete() reports success without deleting the token - CVE-2026-114138: crafted Accept headers make content negotiation burn seconds of CPU per request, exhausting workers	2026-10-23 21:46:44 +02:00
briquet	1717c65f2b	🔒️(frontend) upgrade nginx to 1.30.6 to fix CVE-2026-15176 Bump the nginx-unprivileged base image to 1.30.6-alpine3.24, which fixes a heap overflow when using alias with rewrite, along with CVE-2026-93479, CVE-2026-95101 and CVE-2026-97629. https://nginx.org/en/security_advisories.html	2026-10-23 21:46:44 +02:00
briquet	fa20d52248	🔒️(all) upgrade brotli to fix CVE-2026-111497 CVE-2026-111497 is an out-of-bounds write in the brotli decoder, reachable by decompressing crafted brotli data. - backend: upgrade Brotli to 1.2.1, used by urllib3 and aiohttp to decode "Content-Encoding: br" responses - docker: require brotli-libs >= 1.2.1-r0 in the backend, summary and frontend images, the nginx base image ships 1.2.0-r1 - frontend: build the Outlook add-in on Node 22.23.4, Node 20 is EOL and will not get the fix https://www.strix.ai/cve/CVE-2026-111497	2026-10-23 21:46:44 +02:00

Author

SHA1

Message

Date

briquet

21121e8bc1

🔒️(backend) upgrade djangorestframework to 3.18.2

Fix three vulnerabilities in djangorestframework

- CVE-2026-114136: a compressing codec in the Content-Type charset
  lets an unauthenticated body bypass Django's size limit,
  causing memory-amplification denial of service
- CVE-2026-114137: TokenProxy.delete() reports success without deleting
  the token
- CVE-2026-114138: crafted Accept headers make content negotiation burn
  seconds of CPU per request, exhausting workers

2026-10-23 21:46:44 +02:00

briquet

1717c65f2b

🔒️(frontend) upgrade nginx to 1.30.6 to fix CVE-2026-15176

Bump the nginx-unprivileged base image to 1.30.6-alpine3.24, which
fixes a heap overflow when using alias with rewrite, along with
CVE-2026-93479, CVE-2026-95101 and CVE-2026-97629.

https://nginx.org/en/security_advisories.html

2026-10-23 21:46:44 +02:00

briquet

fa20d52248

🔒️(all) upgrade brotli to fix CVE-2026-111497

CVE-2026-111497 is an out-of-bounds write in the brotli decoder,
reachable by decompressing crafted brotli data.

- backend: upgrade Brotli to 1.2.1, used by urllib3 and aiohttp to
  decode "Content-Encoding: br" responses
- docker: require brotli-libs >= 1.2.1-r0 in the backend, summary and
  frontend images, the nginx base image ships 1.2.0-r1
- frontend: build the Outlook add-in on Node 22.23.4, Node 20 is EOL
  and will not get the fix

https://www.strix.ai/cve/CVE-2026-111497

2026-10-23 21:46:44 +02:00

Compare commits

3 Commits

briquet/brotli-nginx-cves .. main

Diff Content Not Available

Compare commits

3 Commits briquet/brotli-nginx-cves .. main

Diff Content Not Available

3 Commits

briquet/brotli-nginx-cves .. main