version/2024.10.3
goauthentik/authentikversion/2024.10.3Nov 21, 2024by authentik-automation[bot]
Upgrading?
AI Summary
A security release addressing multiple vulnerabilities (CVE-2024-52287 and CVE-2024-52289), along with fixes for LDAP permissions, RBAC descriptions, and Content Security Policy (CSP).
Key Highlights
- Fixed security vulnerabilities CVE-2024-52287 and CVE-2024-52289.
- Fixed global search_full_directory permission in LDAP providers.
- Corrected object_description for object-level permissions.
- Added Content Security Policy (CSP) headers to files in `/media`.
Breaking Changes
- Backwards incompatible database changes required for CVE-2024-52289 patches.
Full Release Notes
See https://docs.goauthentik.io/docs/releases/2024.10#fixed-in-2024103 Note that this security release includes backwards incompatible database changes; see https://docs.goauthentik.io/docs/security/cves/CVE-2024-52289#patches ## What's Changed * providers/ldap: fix global search_full_directory permission not being sufficient (cherry-pick #12028) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12030 * rbac: fix incorrect object_description for object-level permissions (cherry-pick #12029) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12043 * web/flows: fix invisible captcha call (cherry-pick #12048) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12049 * core: fix source_flow_manager throwing error when authenticated user attempts to re-authenticate with existing link (cherry-pick #12080) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12081 * providers/scim: accept string and int for SCIM IDs (cherry-pick #12093) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12095 * root: fix activation of locale not being scoped (cherry-pick #12091) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12096 * root: check remote IP for proxy protocol same as HTTP/etc (cherry-pick #12094) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12097 * website/docs: group CVEs by year (cherry-pick #12099) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12100 * internal: add CSP header to files in `/media` (cherry-pick #12092) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12108 * website/docs: add CSP to hardening (cherry-pick #11970) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12116 * security: fix CVE 2024 52287 (cherry-pick #12114) by @gcp-cherry-pick-bot in https://github.com/goauthentik/authentik/pull/12117 **Full Changelog**: https://github.com/goauthentik/authentik/compare/version/2024.10.2...version/2024.10.3
Related Repositories
public-apis/public-apis★ 491,236
A collective list of free APIs
NousResearch/hermes-agent★ 256,111
The agent that grows with you
yt-dlp/yt-dlp★ 200,282
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,572
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.