This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.

Jens L b0fbd576fc security: cure53 fix (#6039) ... * ATH-01-001: resolve path and check start before loading blueprints This is even less of an issue since 411ef239f6, since with that commit we only allow files that the listing returns Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-010: fix missing user filter for webauthn device This prevents an attack that is only possible when an attacker can intercept HTTP traffic and in the case of HTTPS decrypt it. * ATH-01-008: fix web forms not submitting correctly when pressing enter When submitting some forms with the Enter key instead of clicking "Confirm"/etc, the form would not get submitted correctly This would in the worst case is when setting a user's password, where the new password can end up in the URL, but the password was not actually saved to the user. * ATH-01-004: remove env from admin system endpoint this endpoint already required admin access, but for debugging the env variables are used very little Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-003 / ATH-01-012: disable htmlLabels in mermaid Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-005: use hmac.compare_digest for secret_key authentication Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-009: migrate impersonation to use API Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-010: rework Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-014: save authenticator validation state in flow context Signed-off-by: Jens Langhammer <jens@goauthentik.io> bugfixes Signed-off-by: Jens Langhammer <jens@goauthentik.io> * ATH-01-012: escape quotation marks Signed-off-by: Jens Langhammer <jens@goauthentik.io> * add website Signed-off-by: Jens Langhammer <jens@goauthentik.io> * update release ntoes Signed-off-by: Jens Langhammer <jens@goauthentik.io> * update with all notes Signed-off-by: Jens Langhammer <jens@goauthentik.io> * fix format Signed-off-by: Jens Langhammer <jens@goauthentik.io> --------- Signed-off-by: Jens Langhammer <jens@goauthentik.io>		2023-06-22 22:25:04 +02:00
..
2023-06-cure53.md	security: cure53 fix (#6039)	2023-06-22 22:25:04 +02:00
CVE-2022-23555.md	website: link CVE and attribute reporter	2022-12-25 14:17:17 +01:00
CVE-2022-46145.md	website: link CVE and attribute reporter	2022-12-25 14:17:17 +01:00
CVE-2022-46172.md	website: link CVE and attribute reporter	2022-12-25 14:17:17 +01:00
CVE-2023-26481.md	security: fix CVE-2023-26481 (#4832)	2023-03-02 20:15:33 +01:00
policy.mdx	root: rework and expand security policy	2022-11-28 12:10:53 +01:00