Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Avoid Permissions leaking between auth callbacks #33

Merged
merged 1 commit into from
Jan 28, 2025
Merged

fix: Avoid Permissions leaking between auth callbacks #33

merged 1 commit into from
Jan 28, 2025

Conversation

caarlos0
Copy link
Member

@caarlos0 caarlos0 commented Jan 15, 2025 •
edited
Loading

Applying gliderlabs#243 to our fork.

I think we probably have less legacy apps using our lib, and I haven't seen anyone relying on this behavior.

I did tried a bunch of examples, and all of them worked as expected.

CVE-2024-45337

@caarlos0 caarlos0 self-assigned this Jan 15, 2025
@caarlos0 caarlos0 added the bug Something isn't working label Jan 15, 2025
@caarlos0 caarlos0 requested a review from aymanbagabas January 15, 2025 14:36
aymanbagabas
aymanbagabas approved these changes Jan 28, 2025
View reviewed changes
Copy link
Member

@aymanbagabas aymanbagabas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fwiw, Soft Serve is doing something similar that records the key fingerprint and denies the connection if it's different in the session handler

@caarlos0 caarlos0 merged commit 8f999e5 into master Jan 28, 2025
14 checks passed
@caarlos0 caarlos0 deleted the sec branch January 28, 2025 16:18
@caarlos0 caarlos0 mentioned this pull request Jan 28, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@aymanbagabas aymanbagabas aymanbagabas approved these changes

Assignees

@caarlos0 caarlos0

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@caarlos0 @aymanbagabas