This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+3 more
Affected surfaces
Summary
AI summarySecurity hotfix addresses a vulnerability in exported data handling and adds missing permission checks to the fingerprint endpoint.
Full changelog
Engine versions
- Node:
22.16.0 - Deno:
1.43.5 - MongoDB:
5.0, 6.0, 7.0 - Apps-Engine:
1.55.3
Patch Changes
-
Bump @rocket.chat/meteor version.
-
(#40924 by @dionisio-bot) Escapes HTML tags in exported data
-
(#40899 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
-
(#40912 by @dionisio-bot) Fixes missing permission check on the
POST /api/v1/fingerprintendpoint -
Updated dependencies []:
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
Security Fixes
- Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates) — details not explicitly listed in changelog
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Beta — feedback welcome: [email protected]