Directus v11.17.0 Security Update: Aggregation Sanitization Fix and Cookie Secure Attribute Support

Based on the provided GitHub Release page screenshot, here is the summary of security/vulnerability-related information: Vulnerability and Security Information Summary 1. Vulnerability Overview This page contains the release notes for Directus v11.17.0. It does not explicitly list specific CVE identifiers or a dedicated security advisory. However, it includes the following security-related fixes and improvements: Aggregation Query Sanitization Fix: Mentioned under the section as "Fixed aggregation sanitization," which typically addresses potential injection risks or data leakage issues. Cookie Security Attribute Support: Mentioned under the section as "Added support for setting the attribute on OpenID/OAuth2 cookies," allowing the enforcement of HTTPS-only cookie transmission via the environment variable. Cross-Origin Policy Support: Mentioned under the section as "Added cross origin opener policy settings," designed to enhance browser security isolation policies. 2. Scope of Impact Affected Versions: All versions of Directus prior to v11.17.0. Affected Components: The OpenID/OAuth2 authentication flow, aggregation query functionality, and cross-origin policy configuration. 3. Remediation Version Upgrade: Upgrade the Directus system to v11.17.0 or a higher version. Configuration Adjustment: After upgrading, it is recommended to configure the environment variable to ensure secure cookie transmission and enable cross-origin opener policies as needed. 4. POC Code The page does not contain any specific Proof of Concept (POC) code or attack scripts.

Goal Reached Thanks to every supporter — we hit 100%!

Directus v11.17.0 Security Update: Aggregation Sanitization Fix and Cookie Secure Attribute Support

More from this source