Rocket.Chat

v8.5.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Communication & Email

✓ No known CVEs patched

This release patches 1 known CVE

Topics

chat collaboration free javascript meteor mit

+3 more

real-time slack webrtc

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Security hotfix addresses vulnerabilities and missing permission check on the /api/v1/fingerprint endpoint.

Full changelog

Bump @rocket.chat/meteor version.
Bump @rocket.chat/meteor version.
(#40917 by @dionisio-bot) Escapes HTML tags in exported data
(#40891 by @dionisio-bot) Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
(#40904 by @dionisio-bot) Fixes missing permission check on the POST /api/v1/fingerprint endpoint
(#40938 by @dionisio-bot) Fixes an issue where description was incorrectly being used as alternative text for image attachments
Updated dependencies [01a184640f635866bf4c1c612696acc4eed62311]:
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]
- @rocket.chat/[email protected]

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Rocket.Chat

Get notified when new releases ship.

About Rocket.Chat

The Secure CommsOS™ for mission-critical operations