v0.13.52 Security Patches: Privilege Escalation Fix and Tenant Isolation Hardening

Based on the provided webpage screenshot, here is a summary of the key vulnerability information: Vulnerability Overview Vulnerability Name: Not explicitly specified; however, it involves multiple security-related fixes and improvements. Vulnerability Description: Version v0.13.52 primarily focuses on enhancing system security, stability, and functional improvements. This includes optimizations in the API layer, session management, permission controls, and resource isolation. Scope of Impact Affected Components: - API layer (R4 API layers) - Session management - Permission management - Resource isolation - Other related components (e.g., YAML and JSON file preview, token refresh) Remediation Measures API Layer Fixes: - Clarified routes; services read models from HTTP, workers, and IAM (refactor(api): R4 API layers — explicit routes, services free of HTTP, workers/, iam read models by @DimitrijeGlibic in #9200) - Fixed project snapshot bucket import cycles (refactor(api): break the project-snapshot barrel import cycles (KRTX-1598) by @agent-kortix in #9140) Session Management Fixes: - Fixed issues where sessions could not be restarted, stopped, or deleted if users lacked the necessary permissions (fix(web): members are not offered session Restart, Stop or Delete they cannot use by @Ino-Bagaric in #9211) - Fixed session restoration wait state, ensuring proper quota error messaging instead of generic start errors (fix(sessions): a full sandbox-provider storage quota says so instead of “could not start. Try again” by @Ino-Bagaric in #9236) Permission Control Fixes: - Fixed privilege escalation issues where "Only you" secrets remained closed when the holder was promoted, removed, or their group deleted (fix(api): an “Only you” secret stays closed when its holder is promoted, removed or its group deleted by @Ino-Bagaric in #9231) - Fixed labeling of manual triggers in the sessions list to correctly reflect their manual nature (fix(api): label a manual trigger fire as manual in the sessions list (KRTX-1676) by @agent-kortix in #9224) Resource Isolation Fixes: - Hardened tenant isolation across invites, usage, gateway edge, setup links, and impersonation (fix(auth): tenant-isolation hardening (invites, usage, gateway edge, setup links, impersonation) by @markokraemer in #9272) - Fixed runtime stream issues where keep-alive polls did not properly undo stop commands, including deduplication of claims and bounding of runtime streams (fix(runtime): a keep-alive poll never undoes a stop; release dedupe claims, bound the runtime streams by @markokraemer in #9273) Other Fixes: - Restored YAML and JSON file preview functionality (fix(web): YAML and JSON files preview again.) - Ensured that 401 responses trigger fresh token fetches across all apps (fix(api): a 401 makes every app fetch a fresh token.) - Closed gaps in usage metering where streams could go unbilled and ensured correct clawback of refunds (fix(web): Usage metering closes gaps where a stream could go unbilled, and refunds are clawed back correctly.) POC Code or Exploit Code No specific POC code or exploit code was provided on the page. Summary Version v0.13.52 significantly enhances system security and stability through a series of fixes and improvements, particularly in the API layer, session management, permission control, and resource isolation. These updates help mitigate potential security vulnerabilities and ensure the smooth operation of the system.

Goal Reached Thanks to every supporter — we hit 100%!

v0.13.52 Security Patches: Privilege Escalation Fix and Tenant Isolation Hardening

More from this source