From c2bd457557e1003b8ef4260d0e3953145a599dac Mon Sep 17 00:00:00 2001 From: Chocobozzz Date: Tue, 4 Aug 2026 08:13:30 +0200 Subject: [PATCH] Update changelog --- CHANGELOG.md | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 13c9af83ab..d12c20c4fc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,13 @@ # Changelog +## v8.2.4 + +### SECURITY + +This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.3**. +In a few days, this changelog will be updated to disclose the vulnerabilities. + + ## v8.2.3 ### SECURITY @@ -49,8 +57,18 @@ We strongly recommend all administrators upgrade immediately. ### SECURITY -This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.1**. Security hardening is also included. -In a few weeks, this changelog will be updated to disclose the vulnerabilities. +This release addresses vulnerabilities ranging from medium to high severity affecting PeerTube **<= 8.2.2**. Security hardening is also included. + + * **critical** Ensure actor that signs the activity and the video are on the same host when receiving an `Update` activity [GHSA-g9p4-f7h8-hc86](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-g9p4-f7h8-hc86) + * **high** Check HLS filename when proxifying HLS files from object storage [GHSA-93rr-g3x2-ffv4](https://github.com/Chocobozzz/PeerTube/security/advisories/GHSA-93rr-g3x2-ffv4) + * **medium** Ensure element belongs to the playlist on update/remove + * **medium** Do not leak video UUID on invalid video view + * **medium** Ensure user has rights to see private live specific metadata + * **hardening** Ensure ZIP entry filename is valid when extracting a ZIP export + * **hardening** Escape admin configuration when injecting it in HTML + * **hardening** Ensure version from plugin index is valid before injecting it in the CLI + * **hardening** Check caption VTT validity when adding a caption to a video + * **hardening** Invalidate all user tokens on password reset or password change ### Bug fixes