Gramps Web

v3.17.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

flask genealogy gramps python rest

Affected surfaces

auth

Summary

AI summary

Password reset endpoint now returns uniform status to prevent username enumeration.

Full changelog

New features

There is a new JSON logging option that is particularly useful for cloud-based deployments https://github.com/gramps-project/gramps-web-api/pull/878
Media objects that have map coordinates can now be accessed as raster tiles https://github.com/gramps-project/gramps-web-api/pull/879
The new /api/trees/-/verify endpoint allows to execute Gramps' data verification tool https://github.com/gramps-project/gramps-web-api/pull/883

Bug fixes

Catch handle error in indexer in https://github.com/gramps-project/gramps-web-api/pull/877

Security

The password reset endpoint returned an error on non-existing usernames. This was changed now to always return the same status (regardless of whether the reset was successful or not), so a malicious actor cannot enumerate existing user names (i.e. discover the existence of a user account with a specific name) by brute force. Note: the endpoint already had a rate limit of 1/second, so the impact is minor. Thanks to @avduarte333 for flagging this issue. Fixed in https://github.com/gramps-project/gramps-web-api/pull/884

Full Changelog: https://github.com/gramps-project/gramps-web-api/compare/v3.16.0...v3.17.0

Security Fixes

Password reset endpoint now returns identical status regardless of user existence, preventing username enumeration (GHSA fix).

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Gramps Web

Get notified when new releases ship.

About Gramps Web

Web app for collaborative genealogy, based on and interoperable with Gramps, the open source genealogy desktop application.

All releases →